test(audit_info): refactor

This commit is contained in:
Pepe Fagoaga
2023-12-04 15:57:04 +01:00
parent 620de6f68e
commit 70fde82284
328 changed files with 3594 additions and 7345 deletions
+2
View File
@@ -17,6 +17,7 @@ def set_mocked_aws_audit_info(
audited_account: str = AWS_ACCOUNT_NUMBER,
audited_account_arn: str = AWS_ACCOUNT_ARN,
expected_checks: [str] = [],
audit_config: dict = {},
):
audit_info = AWS_Audit_Info(
session_config=None,
@@ -30,6 +31,7 @@ def set_mocked_aws_audit_info(
audited_user_id=None,
audited_partition=AWS_COMMERCIAL_PARTITION,
audited_identity_arn=None,
audit_config=audit_config,
profile=None,
profile_region=None,
credentials=None,
+39 -29
View File
@@ -14,9 +14,10 @@ from prowler.providers.aws.aws_provider import (
)
from prowler.providers.aws.lib.audit_info.models import AWS_Assume_Role, AWS_Audit_Info
from prowler.providers.common.models import Audit_Metadata
ACCOUNT_ID = 123456789012
AWS_REGION = "us-east-1"
from tests.providers.aws.audit_info_utils import (
AWS_ACCOUNT_NUMBER,
AWS_REGION_EU_WEST_1,
)
class Test_AWS_Provider:
@@ -26,7 +27,7 @@ class Test_AWS_Provider:
audited_regions = ["eu-west-1"]
# sessionName = "ProwlerAsessmentSession"
# Boto 3 client to create our user
iam_client = boto3.client("iam", region_name=AWS_REGION)
iam_client = boto3.client("iam", region_name=AWS_REGION_EU_WEST_1)
# IAM user
iam_user = iam_client.create_user(UserName="test-user")["User"]
access_key = iam_client.create_access_key(UserName=iam_user["UserName"])[
@@ -38,7 +39,7 @@ class Test_AWS_Provider:
session = boto3.session.Session(
aws_access_key_id=access_key_id,
aws_secret_access_key=secret_access_key,
region_name=AWS_REGION,
region_name=AWS_REGION_EU_WEST_1,
)
# Fulfil the input session object for Prowler
@@ -75,7 +76,10 @@ class Test_AWS_Provider:
# Call assume_role
with patch(
"prowler.providers.aws.aws_provider.input_role_mfa_token_and_code",
return_value=(f"arn:aws:iam::{ACCOUNT_ID}:mfa/test-role-mfa", "111111"),
return_value=(
f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:mfa/test-role-mfa",
"111111",
),
):
aws_provider = AWS_Provider(audit_info)
assert aws_provider.aws_session.region_name is None
@@ -91,7 +95,7 @@ class Test_AWS_Provider:
def test_aws_provider_user_with_mfa(self):
audited_regions = "eu-west-1"
# Boto 3 client to create our user
iam_client = boto3.client("iam", region_name=AWS_REGION)
iam_client = boto3.client("iam", region_name=AWS_REGION_EU_WEST_1)
# IAM user
iam_user = iam_client.create_user(UserName="test-user")["User"]
access_key = iam_client.create_access_key(UserName=iam_user["UserName"])[
@@ -103,7 +107,7 @@ class Test_AWS_Provider:
session = boto3.session.Session(
aws_access_key_id=access_key_id,
aws_secret_access_key=secret_access_key,
region_name=AWS_REGION,
region_name=AWS_REGION_EU_WEST_1,
)
# Fulfil the input session object for Prowler
@@ -117,7 +121,7 @@ class Test_AWS_Provider:
audited_identity_arn=None,
audited_user_id=None,
profile=None,
profile_region=AWS_REGION,
profile_region=AWS_REGION_EU_WEST_1,
credentials=None,
assumed_role_info=AWS_Assume_Role(
role_arn=None,
@@ -134,7 +138,10 @@ class Test_AWS_Provider:
# # Call assume_role
with patch(
"prowler.providers.aws.aws_provider.input_role_mfa_token_and_code",
return_value=(f"arn:aws:iam::{ACCOUNT_ID}:mfa/test-role-mfa", "111111"),
return_value=(
f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:mfa/test-role-mfa",
"111111",
),
):
aws_provider = AWS_Provider(audit_info)
assert aws_provider.aws_session.region_name is None
@@ -150,12 +157,12 @@ class Test_AWS_Provider:
def test_aws_provider_assume_role_with_mfa(self):
# Variables
role_name = "test-role"
role_arn = f"arn:aws:iam::{ACCOUNT_ID}:role/{role_name}"
role_arn = f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:role/{role_name}"
session_duration_seconds = 900
audited_regions = ["eu-west-1"]
sessionName = "ProwlerAsessmentSession"
# Boto 3 client to create our user
iam_client = boto3.client("iam", region_name=AWS_REGION)
iam_client = boto3.client("iam", region_name=AWS_REGION_EU_WEST_1)
# IAM user
iam_user = iam_client.create_user(UserName="test-user")["User"]
access_key = iam_client.create_access_key(UserName=iam_user["UserName"])[
@@ -167,7 +174,7 @@ class Test_AWS_Provider:
session = boto3.session.Session(
aws_access_key_id=access_key_id,
aws_secret_access_key=secret_access_key,
region_name=AWS_REGION,
region_name=AWS_REGION_EU_WEST_1,
)
# Fulfil the input session object for Prowler
@@ -206,7 +213,10 @@ class Test_AWS_Provider:
# Patch MFA
with patch(
"prowler.providers.aws.aws_provider.input_role_mfa_token_and_code",
return_value=(f"arn:aws:iam::{ACCOUNT_ID}:mfa/test-role-mfa", "111111"),
return_value=(
f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:mfa/test-role-mfa",
"111111",
),
):
assume_role_response = assume_role(
aws_provider.aws_session, aws_provider.role_info
@@ -225,7 +235,7 @@ class Test_AWS_Provider:
# Assumed Role
assert (
assume_role_response["AssumedRoleUser"]["Arn"]
== f"arn:aws:sts::{ACCOUNT_ID}:assumed-role/{role_name}/{sessionName}"
== f"arn:aws:sts::{AWS_ACCOUNT_NUMBER}:assumed-role/{role_name}/{sessionName}"
)
# AssumedRoleUser
@@ -245,12 +255,12 @@ class Test_AWS_Provider:
def test_aws_provider_assume_role_without_mfa(self):
# Variables
role_name = "test-role"
role_arn = f"arn:aws:iam::{ACCOUNT_ID}:role/{role_name}"
role_arn = f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:role/{role_name}"
session_duration_seconds = 900
audited_regions = "eu-west-1"
sessionName = "ProwlerAsessmentSession"
# Boto 3 client to create our user
iam_client = boto3.client("iam", region_name=AWS_REGION)
iam_client = boto3.client("iam", region_name=AWS_REGION_EU_WEST_1)
# IAM user
iam_user = iam_client.create_user(UserName="test-user")["User"]
access_key = iam_client.create_access_key(UserName=iam_user["UserName"])[
@@ -262,7 +272,7 @@ class Test_AWS_Provider:
session = boto3.session.Session(
aws_access_key_id=access_key_id,
aws_secret_access_key=secret_access_key,
region_name=AWS_REGION,
region_name=AWS_REGION_EU_WEST_1,
)
# Fulfil the input session object for Prowler
@@ -315,7 +325,7 @@ class Test_AWS_Provider:
# Assumed Role
assert (
assume_role_response["AssumedRoleUser"]["Arn"]
== f"arn:aws:sts::{ACCOUNT_ID}:assumed-role/{role_name}/{sessionName}"
== f"arn:aws:sts::{AWS_ACCOUNT_NUMBER}:assumed-role/{role_name}/{sessionName}"
)
# AssumedRoleUser
@@ -335,14 +345,14 @@ class Test_AWS_Provider:
def test_assume_role_with_sts_endpoint_region(self):
# Variables
role_name = "test-role"
role_arn = f"arn:aws:iam::{ACCOUNT_ID}:role/{role_name}"
role_arn = f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:role/{role_name}"
session_duration_seconds = 900
aws_region = "eu-west-1"
sts_endpoint_region = aws_region
audited_regions = [aws_region]
sessionName = "ProwlerAsessmentSession"
# Boto 3 client to create our user
iam_client = boto3.client("iam", region_name=AWS_REGION)
iam_client = boto3.client("iam", region_name=AWS_REGION_EU_WEST_1)
# IAM user
iam_user = iam_client.create_user(UserName="test-user")["User"]
access_key = iam_client.create_access_key(UserName=iam_user["UserName"])[
@@ -354,7 +364,7 @@ class Test_AWS_Provider:
session = boto3.session.Session(
aws_access_key_id=access_key_id,
aws_secret_access_key=secret_access_key,
region_name=AWS_REGION,
region_name=AWS_REGION_EU_WEST_1,
)
# Fulfil the input session object for Prowler
@@ -407,7 +417,7 @@ class Test_AWS_Provider:
# Assumed Role
assert (
assume_role_response["AssumedRoleUser"]["Arn"]
== f"arn:aws:sts::{ACCOUNT_ID}:assumed-role/{role_name}/{sessionName}"
== f"arn:aws:sts::{AWS_ACCOUNT_NUMBER}:assumed-role/{role_name}/{sessionName}"
)
# AssumedRoleUser
@@ -425,9 +435,9 @@ class Test_AWS_Provider:
def test_generate_regional_clients(self):
# New Boto3 session with the previously create user
session = boto3.session.Session(
region_name=AWS_REGION,
region_name=AWS_REGION_EU_WEST_1,
)
audited_regions = ["eu-west-1", AWS_REGION]
audited_regions = ["eu-west-1", AWS_REGION_EU_WEST_1]
# Fulfil the input session object for Prowler
audit_info = AWS_Audit_Info(
session_config=None,
@@ -462,10 +472,10 @@ class Test_AWS_Provider:
def test_generate_regional_clients_global_service(self):
# New Boto3 session with the previously create user
session = boto3.session.Session(
region_name=AWS_REGION,
region_name=AWS_REGION_EU_WEST_1,
)
audited_regions = ["eu-west-1", AWS_REGION]
profile_region = AWS_REGION
audited_regions = ["eu-west-1", AWS_REGION_EU_WEST_1]
profile_region = AWS_REGION_EU_WEST_1
# Fulfil the input session object for Prowler
audit_info = AWS_Audit_Info(
session_config=None,
@@ -500,7 +510,7 @@ class Test_AWS_Provider:
def test_generate_regional_clients_cn_partition(self):
# New Boto3 session with the previously create user
session = boto3.session.Session(
region_name=AWS_REGION,
region_name=AWS_REGION_EU_WEST_1,
)
audited_regions = ["cn-northwest-1", "cn-north-1"]
# Fulfil the input session object for Prowler
+1 -1
View File
@@ -287,7 +287,7 @@ class Test_ARN_Parsing:
assert error._excinfo[0] == RoleArnParsingServiceNotIAMnorSTS
def test_iam_credentials_arn_parsing_raising_RoleArnParsingInvalidAccountID(self):
input_arn = "arn:aws:iam::AWS_ACCOUNT_ID:user/prowler"
input_arn = "arn:aws:iam::AWS_ACCOUNT_NUMBER:user/prowler"
with raises(RoleArnParsingInvalidAccountID) as error:
parse_iam_credentials_arn(input_arn)
+12 -7
View File
@@ -7,9 +7,10 @@ from moto import mock_s3
from prowler.config.config import csv_file_suffix
from prowler.providers.aws.lib.s3.s3 import get_s3_object_path, send_to_s3_bucket
AWS_ACCOUNT_ID = "123456789012"
AWS_REGION = "us-east-1"
from tests.providers.aws.audit_info_utils import (
AWS_ACCOUNT_NUMBER,
AWS_REGION_EU_WEST_1,
)
ACTUAL_DIRECTORY = Path(path.dirname(path.realpath(__file__)))
FIXTURES_DIR_NAME = "fixtures"
@@ -27,8 +28,10 @@ class TestS3:
audit_info = MagicMock()
# Create mock session
audit_info.audit_session = boto3.session.Session(region_name=AWS_REGION)
audit_info.audited_account = AWS_ACCOUNT_ID
audit_info.audit_session = boto3.session.Session(
region_name=AWS_REGION_EU_WEST_1
)
audit_info.audited_account = AWS_ACCOUNT_NUMBER
# Create mock bucket
client = audit_info.audit_session.client("s3")
@@ -66,8 +69,10 @@ class TestS3:
audit_info = MagicMock()
# Create mock session
audit_info.audit_session = boto3.session.Session(region_name=AWS_REGION)
audit_info.audited_account = AWS_ACCOUNT_ID
audit_info.audit_session = boto3.session.Session(
region_name=AWS_REGION_EU_WEST_1
)
audit_info.audited_account = AWS_ACCOUNT_NUMBER
# Create mock bucket
client = audit_info.audit_session.client("s3")
@@ -3,13 +3,15 @@ from unittest import mock
from prowler.providers.aws.services.accessanalyzer.accessanalyzer_service import (
Analyzer,
)
from tests.providers.aws.audit_info_utils import (
AWS_ACCOUNT_ARN,
AWS_ACCOUNT_NUMBER,
AWS_REGION_EU_WEST_1,
AWS_REGION_EU_WEST_2,
)
AWS_REGION_1 = "eu-west-1"
AWS_REGION_2 = "eu-west-2"
AWS_ACCOUNT_NUMBER = "123456789012"
AWS_ACCOUNT_ARN = f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root"
ACCESS_ANALYZER_NAME = "test-analyzer"
ACCESS_ANALYZER_ARN = f"arn:aws:access-analyzer:{AWS_REGION_2}:{AWS_ACCOUNT_NUMBER}:analyzer/{ACCESS_ANALYZER_NAME}"
ACCESS_ANALYZER_ARN = f"arn:aws:access-analyzer:{AWS_REGION_EU_WEST_2}:{AWS_ACCOUNT_NUMBER}:analyzer/{ACCESS_ANALYZER_NAME}"
class Test_accessanalyzer_enabled:
@@ -33,7 +35,7 @@ class Test_accessanalyzer_enabled:
def test_one_analyzer_not_available(self):
# Include analyzers to check
accessanalyzer_client = mock.MagicMock
accessanalyzer_client.region = AWS_REGION_1
accessanalyzer_client.region = AWS_REGION_EU_WEST_1
accessanalyzer_client.analyzers = [
Analyzer(
arn=AWS_ACCOUNT_ARN,
@@ -41,7 +43,7 @@ class Test_accessanalyzer_enabled:
status="NOT_AVAILABLE",
tags=[],
type="",
region=AWS_REGION_1,
region=AWS_REGION_EU_WEST_1,
)
]
with mock.patch(
@@ -63,13 +65,13 @@ class Test_accessanalyzer_enabled:
)
assert result[0].resource_id == AWS_ACCOUNT_NUMBER
assert result[0].resource_arn == AWS_ACCOUNT_ARN
assert result[0].region == AWS_REGION_1
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].resource_tags == []
def test_one_analyzer_not_available_allowlisted(self):
# Include analyzers to check
accessanalyzer_client = mock.MagicMock
accessanalyzer_client.region = AWS_REGION_2
accessanalyzer_client.region = AWS_REGION_EU_WEST_2
accessanalyzer_client.audit_config = {"allowlist_non_default_regions": True}
accessanalyzer_client.analyzers = [
Analyzer(
@@ -78,7 +80,7 @@ class Test_accessanalyzer_enabled:
status="NOT_AVAILABLE",
tags=[],
type="",
region=AWS_REGION_1,
region=AWS_REGION_EU_WEST_1,
)
]
with mock.patch(
@@ -100,12 +102,12 @@ class Test_accessanalyzer_enabled:
)
assert result[0].resource_id == AWS_ACCOUNT_NUMBER
assert result[0].resource_arn == AWS_ACCOUNT_ARN
assert result[0].region == AWS_REGION_1
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].resource_tags == []
def test_two_analyzers(self):
accessanalyzer_client = mock.MagicMock
accessanalyzer_client.region = AWS_REGION_1
accessanalyzer_client.region = AWS_REGION_EU_WEST_1
accessanalyzer_client.analyzers = [
Analyzer(
arn=AWS_ACCOUNT_ARN,
@@ -113,7 +115,7 @@ class Test_accessanalyzer_enabled:
status="NOT_AVAILABLE",
tags=[],
type="",
region=AWS_REGION_1,
region=AWS_REGION_EU_WEST_1,
),
Analyzer(
arn=ACCESS_ANALYZER_ARN,
@@ -121,7 +123,7 @@ class Test_accessanalyzer_enabled:
status="ACTIVE",
tags=[],
type="",
region=AWS_REGION_2,
region=AWS_REGION_EU_WEST_2,
),
]
@@ -148,7 +150,7 @@ class Test_accessanalyzer_enabled:
assert result[0].resource_id == AWS_ACCOUNT_NUMBER
assert result[0].resource_arn == AWS_ACCOUNT_ARN
assert result[0].resource_tags == []
assert result[0].region == AWS_REGION_1
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[1].status == "PASS"
assert (
@@ -158,7 +160,7 @@ class Test_accessanalyzer_enabled:
assert result[1].resource_id == ACCESS_ANALYZER_NAME
assert result[1].resource_arn == ACCESS_ANALYZER_ARN
assert result[1].resource_tags == []
assert result[1].region == AWS_REGION_2
assert result[1].region == AWS_REGION_EU_WEST_2
def test_one_active_analyzer(self):
accessanalyzer_client = mock.MagicMock
@@ -169,7 +171,7 @@ class Test_accessanalyzer_enabled:
status="ACTIVE",
tags=[],
type="",
region=AWS_REGION_2,
region=AWS_REGION_EU_WEST_2,
)
]
@@ -195,4 +197,4 @@ class Test_accessanalyzer_enabled:
assert result[0].resource_id == ACCESS_ANALYZER_NAME
assert result[0].resource_arn == ACCESS_ANALYZER_ARN
assert result[0].resource_tags == []
assert result[0].region == AWS_REGION_2
assert result[0].region == AWS_REGION_EU_WEST_2
@@ -4,13 +4,15 @@ from prowler.providers.aws.services.accessanalyzer.accessanalyzer_service import
Analyzer,
Finding,
)
from tests.providers.aws.audit_info_utils import (
AWS_ACCOUNT_ARN,
AWS_ACCOUNT_NUMBER,
AWS_REGION_EU_WEST_1,
AWS_REGION_EU_WEST_2,
)
AWS_REGION_1 = "eu-west-1"
AWS_REGION_2 = "eu-west-2"
AWS_ACCOUNT_NUMBER = "123456789012"
AWS_ACCOUNT_ARN = f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root"
ACCESS_ANALYZER_NAME = "test-analyzer"
ACCESS_ANALYZER_ARN = f"arn:aws:access-analyzer:{AWS_REGION_2}:{AWS_ACCOUNT_NUMBER}:analyzer/{ACCESS_ANALYZER_NAME}"
ACCESS_ANALYZER_ARN = f"arn:aws:access-analyzer:{AWS_REGION_EU_WEST_2}:{AWS_ACCOUNT_NUMBER}:analyzer/{ACCESS_ANALYZER_NAME}"
class Test_accessanalyzer_enabled_without_findings:
@@ -42,7 +44,7 @@ class Test_accessanalyzer_enabled_without_findings:
tags=[],
type="",
fidings=[],
region=AWS_REGION_1,
region=AWS_REGION_EU_WEST_1,
)
]
with mock.patch(
@@ -68,7 +70,7 @@ class Test_accessanalyzer_enabled_without_findings:
tags=[],
fidings=[],
type="",
region=AWS_REGION_1,
region=AWS_REGION_EU_WEST_1,
),
Analyzer(
arn=ACCESS_ANALYZER_ARN,
@@ -86,7 +88,7 @@ class Test_accessanalyzer_enabled_without_findings:
],
tags=[],
type="",
region=AWS_REGION_2,
region=AWS_REGION_EU_WEST_2,
),
]
@@ -112,7 +114,7 @@ class Test_accessanalyzer_enabled_without_findings:
)
assert result[0].resource_id == ACCESS_ANALYZER_NAME
assert result[0].resource_arn == ACCESS_ANALYZER_ARN
assert result[0].region == AWS_REGION_2
assert result[0].region == AWS_REGION_EU_WEST_2
assert result[0].resource_tags == []
def test_one_active_analyzer_without_findings(self):
@@ -125,7 +127,7 @@ class Test_accessanalyzer_enabled_without_findings:
tags=[],
fidings=[],
type="",
region=AWS_REGION_2,
region=AWS_REGION_EU_WEST_2,
)
]
@@ -149,7 +151,7 @@ class Test_accessanalyzer_enabled_without_findings:
)
assert result[0].resource_id == ACCESS_ANALYZER_NAME
assert result[0].resource_arn == ACCESS_ANALYZER_ARN
assert result[0].region == AWS_REGION_2
assert result[0].region == AWS_REGION_EU_WEST_2
assert result[0].resource_tags == []
def test_one_active_analyzer_not_active_without_findings(self):
@@ -162,7 +164,7 @@ class Test_accessanalyzer_enabled_without_findings:
tags=[],
fidings=[],
type="",
region=AWS_REGION_1,
region=AWS_REGION_EU_WEST_1,
),
]
# Patch AccessAnalyzer Client
@@ -195,7 +197,7 @@ class Test_accessanalyzer_enabled_without_findings:
],
tags=[],
type="",
region=AWS_REGION_1,
region=AWS_REGION_EU_WEST_1,
),
]
@@ -220,5 +222,5 @@ class Test_accessanalyzer_enabled_without_findings:
)
assert result[0].resource_id == ACCESS_ANALYZER_NAME
assert result[0].resource_arn == ACCESS_ANALYZER_ARN
assert result[0].region == AWS_REGION_1
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].resource_tags == []
@@ -1,16 +1,18 @@
from unittest import mock
from prowler.providers.aws.services.account.account_service import Contact
from tests.providers.aws.audit_info_utils import (
AWS_ACCOUNT_NUMBER,
AWS_REGION_EU_WEST_1,
)
AWS_ACCOUNT_NUMBER = "123456789012"
AWS_ACCOUNT_ARN = f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root"
AWS_REGION = "us-east-1"
class Test_account_maintain_different_contact_details_to_security_billing_and_operations:
def test_contacts_not_configured_or_equal(self):
account_client = mock.MagicMock
account_client.region = AWS_REGION
account_client.region = AWS_REGION_EU_WEST_1
account_client.audited_account = AWS_ACCOUNT_NUMBER
account_client.audited_account_arn = AWS_ACCOUNT_ARN
@@ -49,13 +51,13 @@ class Test_account_maintain_different_contact_details_to_security_billing_and_op
result[0].status_extended
== "SECURITY, BILLING and OPERATIONS contacts not found or they are not different between each other and between ROOT contact."
)
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].resource_id == AWS_ACCOUNT_NUMBER
assert result[0].resource_arn == AWS_ACCOUNT_ARN
def test_contacts_diffent(self):
account_client = mock.MagicMock
account_client.region = AWS_REGION
account_client.region = AWS_REGION_EU_WEST_1
account_client.audited_account = AWS_ACCOUNT_NUMBER
account_client.audited_account_arn = AWS_ACCOUNT_ARN
@@ -98,6 +100,6 @@ class Test_account_maintain_different_contact_details_to_security_billing_and_op
result[0].status_extended
== "SECURITY, BILLING and OPERATIONS contacts found and they are different between each other and between ROOT contact."
)
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].resource_id == AWS_ACCOUNT_NUMBER
assert result[0].resource_arn == AWS_ACCOUNT_ARN
@@ -2,9 +2,11 @@ import uuid
from unittest import mock
from prowler.providers.aws.services.acm.acm_service import Certificate
from tests.providers.aws.audit_info_utils import (
AWS_ACCOUNT_NUMBER,
AWS_REGION_EU_WEST_1,
)
AWS_REGION = "us-east-1"
AWS_ACCOUNT_NUMBER = "123456789012"
DAYS_TO_EXPIRE_THRESHOLD = 7
@@ -29,7 +31,7 @@ class Test_acm_certificates_expiration_check:
def test_acm_certificate_expirated(self):
certificate_id = str(uuid.uuid4())
certificate_arn = f"arn:aws:acm:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:certificate/{certificate_id}"
certificate_arn = f"arn:aws:acm:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:certificate/{certificate_id}"
certificate_name = "test-certificate.com"
certificate_type = "AMAZON_ISSUED"
@@ -42,7 +44,7 @@ class Test_acm_certificates_expiration_check:
type=certificate_type,
expiration_days=5,
transparency_logging=True,
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
)
]
@@ -66,12 +68,12 @@ class Test_acm_certificates_expiration_check:
)
assert result[0].resource_id == certificate_id
assert result[0].resource_arn == certificate_arn
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].resource_tags == []
def test_acm_certificate_not_expirated(self):
certificate_id = str(uuid.uuid4())
certificate_arn = f"arn:aws:acm:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:certificate/{certificate_id}"
certificate_arn = f"arn:aws:acm:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:certificate/{certificate_id}"
certificate_name = "test-certificate.com"
certificate_type = "AMAZON_ISSUED"
expiration_days = 365
@@ -85,7 +87,7 @@ class Test_acm_certificates_expiration_check:
type=certificate_type,
expiration_days=expiration_days,
transparency_logging=True,
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
)
]
@@ -109,5 +111,5 @@ class Test_acm_certificates_expiration_check:
)
assert result[0].resource_id == certificate_id
assert result[0].resource_arn == certificate_arn
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].resource_tags == []
@@ -2,9 +2,10 @@ import uuid
from unittest import mock
from prowler.providers.aws.services.acm.acm_service import Certificate
AWS_REGION = "us-east-1"
AWS_ACCOUNT_NUMBER = "123456789012"
from tests.providers.aws.audit_info_utils import (
AWS_ACCOUNT_NUMBER,
AWS_REGION_EU_WEST_1,
)
class Test_acm_certificates_transparency_logs_enabled:
@@ -28,7 +29,7 @@ class Test_acm_certificates_transparency_logs_enabled:
def test_acm_certificate_with_logging(self):
certificate_id = str(uuid.uuid4())
certificate_arn = f"arn:aws:acm:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:certificate/{certificate_id}"
certificate_arn = f"arn:aws:acm:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:certificate/{certificate_id}"
certificate_name = "test-certificate.com"
certificate_type = "AMAZON_ISSUED"
@@ -41,7 +42,7 @@ class Test_acm_certificates_transparency_logs_enabled:
type=certificate_type,
expiration_days=365,
transparency_logging=True,
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
)
]
@@ -65,12 +66,12 @@ class Test_acm_certificates_transparency_logs_enabled:
)
assert result[0].resource_id == certificate_id
assert result[0].resource_arn == certificate_arn
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].resource_tags == []
def test_acm_certificate_without_logging(self):
certificate_id = str(uuid.uuid4())
certificate_arn = f"arn:aws:acm:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:certificate/{certificate_id}"
certificate_arn = f"arn:aws:acm:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:certificate/{certificate_id}"
certificate_name = "test-certificate.com"
certificate_type = "AMAZON_ISSUED"
@@ -83,7 +84,7 @@ class Test_acm_certificates_transparency_logs_enabled:
type=certificate_type,
expiration_days=365,
transparency_logging=False,
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
)
]
@@ -107,5 +108,5 @@ class Test_acm_certificates_transparency_logs_enabled:
)
assert result[0].resource_id == certificate_id
assert result[0].resource_arn == certificate_arn
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].resource_tags == []
@@ -129,7 +129,7 @@ class Test_ACM_Service:
# @mock_acm
def test__list_and_describe_certificates__(self):
# Generate ACM Client
# acm_client = client("acm", region_name=AWS_REGION)
# acm_client = client("acm", region_name=AWS_REGION_EU_WEST_1)
# Request ACM certificate
# certificate = acm_client.request_certificate(
# DomainName="test.com",
@@ -150,7 +150,7 @@ class Test_ACM_Service:
# @mock_acm
def test__list_tags_for_certificate__(self):
# Generate ACM Client
# acm_client = client("acm", region_name=AWS_REGION)
# acm_client = client("acm", region_name=AWS_REGION_EU_WEST_1)
# Request ACM certificate
# certificate = acm_client.request_certificate(
# DomainName="test.com",
@@ -1,9 +1,7 @@
from unittest import mock
from prowler.providers.aws.services.appstream.appstream_service import Fleet
# Mock Test Region
AWS_REGION = "eu-west-1"
from tests.providers.aws.audit_info_utils import AWS_REGION_EU_WEST_1
class Test_appstream_fleet_default_internet_access_disabled:
@@ -34,7 +32,7 @@ class Test_appstream_fleet_default_internet_access_disabled:
disconnect_timeout_in_seconds=900,
idle_disconnect_timeout_in_seconds=900,
enable_default_internet_access=True,
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
)
appstream_client.fleets.append(fleet1)
@@ -72,7 +70,7 @@ class Test_appstream_fleet_default_internet_access_disabled:
disconnect_timeout_in_seconds=900,
idle_disconnect_timeout_in_seconds=900,
enable_default_internet_access=False,
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
)
appstream_client.fleets.append(fleet1)
@@ -110,7 +108,7 @@ class Test_appstream_fleet_default_internet_access_disabled:
disconnect_timeout_in_seconds=900,
idle_disconnect_timeout_in_seconds=900,
enable_default_internet_access=True,
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
)
fleet2 = Fleet(
arn="arn",
@@ -119,7 +117,7 @@ class Test_appstream_fleet_default_internet_access_disabled:
disconnect_timeout_in_seconds=900,
idle_disconnect_timeout_in_seconds=900,
enable_default_internet_access=False,
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
)
appstream_client.fleets.append(fleet1)
@@ -1,9 +1,7 @@
from unittest import mock
from prowler.providers.aws.services.appstream.appstream_service import Fleet
# Mock Test Region
AWS_REGION = "eu-west-1"
from tests.providers.aws.audit_info_utils import AWS_REGION_EU_WEST_1
class Test_appstream_fleet_maximum_session_duration:
@@ -35,7 +33,7 @@ class Test_appstream_fleet_maximum_session_duration:
disconnect_timeout_in_seconds=900,
idle_disconnect_timeout_in_seconds=900,
enable_default_internet_access=True,
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
)
appstream_client.fleets.append(fleet1)
@@ -76,7 +74,7 @@ class Test_appstream_fleet_maximum_session_duration:
disconnect_timeout_in_seconds=900,
idle_disconnect_timeout_in_seconds=900,
enable_default_internet_access=True,
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
)
appstream_client.fleets.append(fleet1)
@@ -119,7 +117,7 @@ class Test_appstream_fleet_maximum_session_duration:
disconnect_timeout_in_seconds=900,
idle_disconnect_timeout_in_seconds=900,
enable_default_internet_access=True,
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
)
fleet2 = Fleet(
arn="arn",
@@ -129,7 +127,7 @@ class Test_appstream_fleet_maximum_session_duration:
disconnect_timeout_in_seconds=900,
idle_disconnect_timeout_in_seconds=900,
enable_default_internet_access=False,
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
)
appstream_client.fleets.append(fleet1)
@@ -1,9 +1,7 @@
from unittest import mock
from prowler.providers.aws.services.appstream.appstream_service import Fleet
# Mock Test Region
AWS_REGION = "eu-west-1"
from tests.providers.aws.audit_info_utils import AWS_REGION_EU_WEST_1
class Test_appstream_fleet_session_disconnect_timeout:
@@ -35,7 +33,7 @@ class Test_appstream_fleet_session_disconnect_timeout:
disconnect_timeout_in_seconds=1 * 60 * 60,
idle_disconnect_timeout_in_seconds=900,
enable_default_internet_access=True,
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
)
appstream_client.fleets.append(fleet1)
@@ -75,7 +73,7 @@ class Test_appstream_fleet_session_disconnect_timeout:
disconnect_timeout_in_seconds=4 * 60,
idle_disconnect_timeout_in_seconds=900,
enable_default_internet_access=True,
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
)
appstream_client.fleets.append(fleet1)
@@ -118,7 +116,7 @@ class Test_appstream_fleet_session_disconnect_timeout:
disconnect_timeout_in_seconds=1 * 60 * 60,
idle_disconnect_timeout_in_seconds=900,
enable_default_internet_access=True,
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
)
fleet2 = Fleet(
arn="arn",
@@ -128,7 +126,7 @@ class Test_appstream_fleet_session_disconnect_timeout:
disconnect_timeout_in_seconds=3 * 60,
idle_disconnect_timeout_in_seconds=900,
enable_default_internet_access=False,
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
)
appstream_client.fleets.append(fleet1)
@@ -1,9 +1,7 @@
from unittest import mock
from prowler.providers.aws.services.appstream.appstream_service import Fleet
# Mock Test Region
AWS_REGION = "eu-west-1"
from tests.providers.aws.audit_info_utils import AWS_REGION_EU_WEST_1
class Test_appstream_fleet_session_idle_disconnect_timeout:
@@ -35,7 +33,7 @@ class Test_appstream_fleet_session_idle_disconnect_timeout:
# 15 minutes
idle_disconnect_timeout_in_seconds=15 * 60,
enable_default_internet_access=True,
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
)
appstream_client.fleets.append(fleet1)
@@ -76,7 +74,7 @@ class Test_appstream_fleet_session_idle_disconnect_timeout:
# 8 minutes
idle_disconnect_timeout_in_seconds=8 * 60,
enable_default_internet_access=True,
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
)
appstream_client.fleets.append(fleet1)
@@ -119,7 +117,7 @@ class Test_appstream_fleet_session_idle_disconnect_timeout:
# 5 minutes
idle_disconnect_timeout_in_seconds=5 * 60,
enable_default_internet_access=True,
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
)
fleet2 = Fleet(
arn="arn",
@@ -129,7 +127,7 @@ class Test_appstream_fleet_session_idle_disconnect_timeout:
# 45 minutes
idle_disconnect_timeout_in_seconds=45 * 60,
enable_default_internet_access=False,
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
)
appstream_client.fleets.append(fleet1)
@@ -5,14 +5,11 @@ from moto.core import DEFAULT_ACCOUNT_ID
from prowler.providers.aws.services.appstream.appstream_service import AppStream
from tests.providers.aws.audit_info_utils import (
AWS_REGION_EU_WEST_1,
AWS_REGION_US_EAST_1,
set_mocked_aws_audit_info,
)
# Mock Test Region
AWS_REGION = "eu-west-1"
AWS_ACCOUNT_NUMBER = "123456789012"
# Mocking Access Analyzer Calls
make_api_call = botocore.client.BaseClient._make_api_call
@@ -29,7 +26,7 @@ def mock_make_api_call(self, operation_name, kwarg):
return {
"Fleets": [
{
"Arn": f"arn:aws:appstream:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:fleet/test-prowler3-0",
"Arn": f"arn:aws:appstream:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:fleet/test-prowler3-0",
"Name": "test-prowler3-0",
"MaxUserDurationInSeconds": 100,
"DisconnectTimeoutInSeconds": 900,
@@ -37,7 +34,7 @@ def mock_make_api_call(self, operation_name, kwarg):
"EnableDefaultInternetAccess": False,
},
{
"Arn": f"arn:aws:appstream:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:fleet/test-prowler3-1",
"Arn": f"arn:aws:appstream:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:fleet/test-prowler3-1",
"Name": "test-prowler3-1",
"MaxUserDurationInSeconds": 57600,
"DisconnectTimeoutInSeconds": 900,
@@ -53,9 +50,11 @@ def mock_make_api_call(self, operation_name, kwarg):
# Mock generate_regional_clients()
def mock_generate_regional_clients(service, audit_info, _):
regional_client = audit_info.audit_session.client(service, region_name=AWS_REGION)
regional_client.region = AWS_REGION
return {AWS_REGION: regional_client}
regional_client = audit_info.audit_session.client(
service, region_name=AWS_REGION_EU_WEST_1
)
regional_client.region = AWS_REGION_EU_WEST_1
return {AWS_REGION_EU_WEST_1: regional_client}
# Patch every AWS call using Boto3 and generate_regional_clients to have 1 client
@@ -68,7 +67,10 @@ class Test_AppStream_Service:
# Test AppStream Client
def test__get_client__(self):
appstream = AppStream(set_mocked_aws_audit_info([AWS_REGION_US_EAST_1]))
assert appstream.regional_clients[AWS_REGION].__class__.__name__ == "AppStream"
assert (
appstream.regional_clients[AWS_REGION_EU_WEST_1].__class__.__name__
== "AppStream"
)
# Test AppStream Session
def test__get_session__(self):
@@ -87,25 +89,25 @@ class Test_AppStream_Service:
assert (
appstream.fleets[0].arn
== f"arn:aws:appstream:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:fleet/test-prowler3-0"
== f"arn:aws:appstream:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:fleet/test-prowler3-0"
)
assert appstream.fleets[0].name == "test-prowler3-0"
assert appstream.fleets[0].max_user_duration_in_seconds == 100
assert appstream.fleets[0].disconnect_timeout_in_seconds == 900
assert appstream.fleets[0].idle_disconnect_timeout_in_seconds == 900
assert appstream.fleets[0].enable_default_internet_access is False
assert appstream.fleets[0].region == AWS_REGION
assert appstream.fleets[0].region == AWS_REGION_EU_WEST_1
assert (
appstream.fleets[1].arn
== f"arn:aws:appstream:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:fleet/test-prowler3-1"
== f"arn:aws:appstream:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:fleet/test-prowler3-1"
)
assert appstream.fleets[1].name == "test-prowler3-1"
assert appstream.fleets[1].max_user_duration_in_seconds == 57600
assert appstream.fleets[1].disconnect_timeout_in_seconds == 900
assert appstream.fleets[1].idle_disconnect_timeout_in_seconds == 900
assert appstream.fleets[1].enable_default_internet_access is True
assert appstream.fleets[1].region == AWS_REGION
assert appstream.fleets[1].region == AWS_REGION_EU_WEST_1
def test__list_tags_for_resource__(self):
# Set partition for the service
@@ -86,7 +86,7 @@ class Test_Athena_Service:
# Athena client
# This API call is not implemented by Moto
# athena_client = audit_info.audit_session.client(
# "athena", region_name=AWS_REGION
# "athena", region_name=AWS_REGION_EU_WEST_1
# )
# athena_client.update_work_group(
# WorkGroup=default_workgroup_name,
@@ -3,9 +3,10 @@ from unittest import mock
from uuid import uuid4
from prowler.providers.aws.services.backup.backup_service import BackupPlan
AWS_REGION = "eu-west-1"
AWS_ACCOUNT_NUMBER = "123456789012"
from tests.providers.aws.audit_info_utils import (
AWS_ACCOUNT_NUMBER,
AWS_REGION_EU_WEST_1,
)
class Test_backup_plans_exist:
@@ -13,7 +14,7 @@ class Test_backup_plans_exist:
backup_client = mock.MagicMock
backup_client.audited_account = AWS_ACCOUNT_NUMBER
backup_client.audited_account_arn = f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root"
backup_client.region = AWS_REGION
backup_client.region = AWS_REGION_EU_WEST_1
backup_client.backup_plans = []
backup_client.backup_vaults = ["vault"]
with mock.patch(
@@ -33,13 +34,13 @@ class Test_backup_plans_exist:
assert result[0].status_extended == "No Backup Plan exist."
assert result[0].resource_id == AWS_ACCOUNT_NUMBER
assert result[0].resource_arn == f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root"
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
def test_no_backup_plans_not_vaults(self):
backup_client = mock.MagicMock
backup_client.audited_account = AWS_ACCOUNT_NUMBER
backup_client.audited_account_arn = f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root"
backup_client.region = AWS_REGION
backup_client.region = AWS_REGION_EU_WEST_1
backup_client.backup_plans = []
backup_client.backup_vaults = []
with mock.patch(
@@ -60,16 +61,14 @@ class Test_backup_plans_exist:
backup_client = mock.MagicMock
backup_client.audited_account = AWS_ACCOUNT_NUMBER
backup_client.audited_account_arn = f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root"
backup_client.region = AWS_REGION
backup_client.region = AWS_REGION_EU_WEST_1
backup_plan_id = str(uuid4()).upper()
backup_plan_arn = (
f"arn:aws:backup:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:plan:{backup_plan_id}"
)
backup_plan_arn = f"arn:aws:backup:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:plan:{backup_plan_id}"
backup_client.backup_plans = [
BackupPlan(
arn=backup_plan_arn,
id=backup_plan_id,
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
name="MyBackupPlan",
version_id="version_id",
last_execution_date=datetime(2015, 1, 1),
@@ -97,6 +96,6 @@ class Test_backup_plans_exist:
assert result[0].resource_id == "MyBackupPlan"
assert (
result[0].resource_arn
== f"arn:aws:backup:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:plan:{backup_plan_id}"
== f"arn:aws:backup:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:plan:{backup_plan_id}"
)
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
@@ -6,15 +6,16 @@ from prowler.providers.aws.services.backup.backup_service import (
BackupPlan,
BackupReportPlan,
)
AWS_REGION = "eu-west-1"
AWS_ACCOUNT_NUMBER = "123456789012"
from tests.providers.aws.audit_info_utils import (
AWS_ACCOUNT_NUMBER,
AWS_REGION_EU_WEST_1,
)
class Test_backup_reportplans_exist:
def test_no_backup_plans(self):
backup_client = mock.MagicMock
backup_client.region = AWS_REGION
backup_client.region = AWS_REGION_EU_WEST_1
backup_client.backup_plans = []
with mock.patch(
"prowler.providers.aws.services.backup.backup_service.Backup",
@@ -34,16 +35,14 @@ class Test_backup_reportplans_exist:
backup_client = mock.MagicMock
backup_client.audited_account = AWS_ACCOUNT_NUMBER
backup_client.audited_account_arn = f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root"
backup_client.region = AWS_REGION
backup_client.region = AWS_REGION_EU_WEST_1
backup_plan_id = str(uuid4()).upper()
backup_plan_arn = (
f"arn:aws:backup:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:plan:{backup_plan_id}"
)
backup_plan_arn = f"arn:aws:backup:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:plan:{backup_plan_id}"
backup_client.backup_plans = [
BackupPlan(
arn=backup_plan_arn,
id=backup_plan_arn,
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
name="MyBackupPlan",
version_id="version_id",
last_execution_date=datetime(2015, 1, 1),
@@ -68,22 +67,20 @@ class Test_backup_reportplans_exist:
assert result[0].status_extended == "No Backup Report Plan exist."
assert result[0].resource_id == AWS_ACCOUNT_NUMBER
assert result[0].resource_arn == f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root"
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
def test_one_backup_report_plan(self):
backup_client = mock.MagicMock
backup_client.audited_account = AWS_ACCOUNT_NUMBER
backup_client.audited_account_arn = f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root"
backup_client.region = AWS_REGION
backup_client.region = AWS_REGION_EU_WEST_1
backup_plan_id = str(uuid4()).upper()
backup_plan_arn = (
f"arn:aws:backup:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:plan:{backup_plan_id}"
)
backup_plan_arn = f"arn:aws:backup:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:plan:{backup_plan_id}"
backup_client.backup_plans = [
BackupPlan(
arn=backup_plan_arn,
id=backup_plan_id,
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
name="MyBackupPlan",
version_id="version_id",
last_execution_date=datetime(2015, 1, 1),
@@ -91,11 +88,11 @@ class Test_backup_reportplans_exist:
)
]
backup_report_plan_id = str(uuid4()).upper()
backup_report_plan_arn = f"arn:aws:backup:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:report-plan:MyBackupReportPlan-{backup_report_plan_id}"
backup_report_plan_arn = f"arn:aws:backup:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:report-plan:MyBackupReportPlan-{backup_report_plan_id}"
backup_client.backup_report_plans = [
BackupReportPlan(
arn=backup_report_plan_arn,
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
name="MyBackupReportPlan",
last_attempted_execution_date=datetime(2015, 1, 1),
last_successful_execution_date=datetime(2015, 1, 1),
@@ -122,4 +119,4 @@ class Test_backup_reportplans_exist:
)
assert result[0].resource_id == "MyBackupReportPlan"
assert result[0].resource_arn == backup_report_plan_arn
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
@@ -1,9 +1,10 @@
from unittest import mock
from prowler.providers.aws.services.backup.backup_service import BackupVault
AWS_REGION = "eu-west-1"
AWS_ACCOUNT_NUMBER = "0123456789012"
from tests.providers.aws.audit_info_utils import (
AWS_ACCOUNT_NUMBER,
AWS_REGION_EU_WEST_1,
)
class Test_backup_vaults_encrypted:
@@ -26,12 +27,12 @@ class Test_backup_vaults_encrypted:
def test_one_backup_vault_unencrypted(self):
backup_client = mock.MagicMock
backup_vault_arn = f"arn:aws:backup:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:backup-vault:MyBackupVault"
backup_vault_arn = f"arn:aws:backup:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:backup-vault:MyBackupVault"
backup_client.backup_vaults = [
BackupVault(
arn=backup_vault_arn,
name="MyBackupVault",
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
encryption="",
recovery_points=1,
locked=True,
@@ -60,16 +61,16 @@ class Test_backup_vaults_encrypted:
)
assert result[0].resource_id == "MyBackupVault"
assert result[0].resource_arn == backup_vault_arn
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
def test_one_backup_vault_encrypted(self):
backup_client = mock.MagicMock
backup_vault_arn = f"arn:aws:backup:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:backup-vault:MyBackupVault"
backup_vault_arn = f"arn:aws:backup:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:backup-vault:MyBackupVault"
backup_client.backup_vaults = [
BackupVault(
arn=backup_vault_arn,
name="MyBackupVault",
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
encryption="test",
recovery_points=1,
locked=True,
@@ -98,4 +99,4 @@ class Test_backup_vaults_encrypted:
)
assert result[0].resource_id == "MyBackupVault"
assert result[0].resource_arn == backup_vault_arn
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
@@ -1,9 +1,10 @@
from unittest import mock
from prowler.providers.aws.services.backup.backup_service import BackupVault
AWS_REGION = "eu-west-1"
AWS_ACCOUNT_NUMBER = "123456789012"
from tests.providers.aws.audit_info_utils import (
AWS_ACCOUNT_NUMBER,
AWS_REGION_EU_WEST_1,
)
class Test_backup_vaults_exist:
@@ -11,7 +12,7 @@ class Test_backup_vaults_exist:
backup_client = mock.MagicMock
backup_client.audited_account = AWS_ACCOUNT_NUMBER
backup_client.audited_account_arn = f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root"
backup_client.region = AWS_REGION
backup_client.region = AWS_REGION_EU_WEST_1
backup_client.backup_vaults = []
with mock.patch(
"prowler.providers.aws.services.backup.backup_service.Backup",
@@ -30,19 +31,19 @@ class Test_backup_vaults_exist:
assert result[0].status_extended == "No Backup Vault exist."
assert result[0].resource_id == AWS_ACCOUNT_NUMBER
assert result[0].resource_arn == f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root"
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
def test_one_backup_vault(self):
backup_client = mock.MagicMock
backup_client.audited_account = AWS_ACCOUNT_NUMBER
backup_client.audited_account_arn = f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root"
backup_client.region = AWS_REGION
backup_vault_arn = f"arn:aws:backup:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:backup-vault:MyBackupVault"
backup_client.region = AWS_REGION_EU_WEST_1
backup_vault_arn = f"arn:aws:backup:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:backup-vault:MyBackupVault"
backup_client.backup_vaults = [
BackupVault(
arn=backup_vault_arn,
name="MyBackupVault",
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
encryption="",
recovery_points=1,
locked=True,
@@ -71,4 +72,4 @@ class Test_backup_vaults_exist:
)
assert result[0].resource_id == "MyBackupVault"
assert result[0].resource_arn == backup_vault_arn
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
@@ -1,9 +1,7 @@
from unittest import mock
from prowler.providers.aws.services.cloudformation.cloudformation_service import Stack
# Mock Test Region
AWS_REGION = "eu-west-1"
from tests.providers.aws.audit_info_utils import AWS_REGION_EU_WEST_1
class Test_cloudformation_stack_outputs_find_secrets:
@@ -32,7 +30,7 @@ class Test_cloudformation_stack_outputs_find_secrets:
arn="arn:aws:cloudformation:eu-west-1:123456789012:stack/Test-Stack/796c8d26-b390-41d7-a23c-0702c4e78b60",
name=stack_name,
outputs=["DB_PASSWORD:foobar123", "ENV:DEV"],
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
)
]
@@ -58,7 +56,7 @@ class Test_cloudformation_stack_outputs_find_secrets:
result[0].resource_arn
== "arn:aws:cloudformation:eu-west-1:123456789012:stack/Test-Stack/796c8d26-b390-41d7-a23c-0702c4e78b60"
)
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].resource_tags == []
def test_stack_no_secret_in_outputs(self):
@@ -69,7 +67,7 @@ class Test_cloudformation_stack_outputs_find_secrets:
arn="arn:aws:cloudformation:eu-west-1:123456789012:stack/Test-Stack/796c8d26-b390-41d7-a23c-0702c4e78b60",
name=stack_name,
outputs=["ENV:DEV"],
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
)
]
@@ -95,7 +93,7 @@ class Test_cloudformation_stack_outputs_find_secrets:
result[0].resource_arn
== "arn:aws:cloudformation:eu-west-1:123456789012:stack/Test-Stack/796c8d26-b390-41d7-a23c-0702c4e78b60"
)
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].resource_tags == []
def test_stack_no_outputs(self):
@@ -106,7 +104,7 @@ class Test_cloudformation_stack_outputs_find_secrets:
arn="arn:aws:cloudformation:eu-west-1:123456789012:stack/Test-Stack/796c8d26-b390-41d7-a23c-0702c4e78b60",
name=stack_name,
outputs=[],
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
)
]
@@ -132,5 +130,5 @@ class Test_cloudformation_stack_outputs_find_secrets:
result[0].resource_arn
== "arn:aws:cloudformation:eu-west-1:123456789012:stack/Test-Stack/796c8d26-b390-41d7-a23c-0702c4e78b60"
)
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].resource_tags == []
@@ -1,9 +1,7 @@
from unittest import mock
from prowler.providers.aws.services.cloudformation.cloudformation_service import Stack
# Mock Test Region
AWS_REGION = "eu-west-1"
from tests.providers.aws.audit_info_utils import AWS_REGION_EU_WEST_1
class Test_cloudformation_stacks_termination_protection_enabled:
@@ -32,7 +30,7 @@ class Test_cloudformation_stacks_termination_protection_enabled:
arn="arn:aws:cloudformation:eu-west-1:123456789012:stack/Test-Stack/796c8d26-b390-41d7-a23c-0702c4e78b60",
name=stack_name,
outputs=[],
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
)
]
cloudformation_client.stacks[0].enable_termination_protection = True
@@ -59,7 +57,7 @@ class Test_cloudformation_stacks_termination_protection_enabled:
result[0].resource_arn
== "arn:aws:cloudformation:eu-west-1:123456789012:stack/Test-Stack/796c8d26-b390-41d7-a23c-0702c4e78b60"
)
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].resource_tags == []
def test_stack_termination_protection_disabled(self):
@@ -70,7 +68,7 @@ class Test_cloudformation_stacks_termination_protection_enabled:
arn="arn:aws:cloudformation:eu-west-1:123456789012:stack/Test-Stack/796c8d26-b390-41d7-a23c-0702c4e78b60",
name=stack_name,
outputs=[],
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
)
]
cloudformation_client.stacks[0].enable_termination_protection = False
@@ -97,5 +95,5 @@ class Test_cloudformation_stacks_termination_protection_enabled:
result[0].resource_arn
== "arn:aws:cloudformation:eu-west-1:123456789012:stack/Test-Stack/796c8d26-b390-41d7-a23c-0702c4e78b60"
)
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].resource_tags == []
@@ -1,25 +1,19 @@
from unittest.mock import patch
import botocore
from boto3 import client, session
from boto3 import client
from moto import mock_cloudfront
from moto.core import DEFAULT_ACCOUNT_ID
from prowler.providers.aws.lib.audit_info.models import AWS_Audit_Info
from prowler.providers.aws.services.cloudfront.cloudfront_service import (
CloudFront,
GeoRestrictionType,
ViewerProtocolPolicy,
)
from prowler.providers.common.models import Audit_Metadata
from tests.providers.aws.audit_info_utils import (
AWS_REGION_EU_WEST_1,
set_mocked_aws_audit_info,
)
# Mock Test Region
AWS_REGION = "eu-west-1"
def example_distribution_config(ref):
"""Return a basic example distribution config for use in tests."""
@@ -159,37 +153,6 @@ def mock_make_api_call(self, operation_name, kwarg):
# Patch every AWS call using Boto3
@patch("botocore.client.BaseClient._make_api_call", new=mock_make_api_call)
class Test_CloudFront_Service:
def set_mocked_audit_info(self):
audit_info = AWS_Audit_Info(
session_config=None,
original_session=None,
audit_session=session.Session(
profile_name=None,
botocore_session=None,
region_name=AWS_REGION,
),
audited_account=DEFAULT_ACCOUNT_ID,
audited_account_arn=f"arn:aws:iam::{DEFAULT_ACCOUNT_ID}:root",
audited_user_id=None,
audited_partition="aws",
audited_identity_arn=None,
profile=None,
profile_region=AWS_REGION,
credentials=None,
assumed_role_info=None,
audited_regions=None,
organizations_metadata=None,
audit_resources=None,
mfa_enabled=False,
audit_metadata=Audit_Metadata(
services_scanned=0,
expected_checks=[],
completed_checks=0,
audit_progress=0,
),
)
return audit_info
# Test CloudFront Client
@mock_cloudfront
def test__get_client__(self):
@@ -2,55 +2,21 @@ from unittest import mock
from unittest.mock import patch
import botocore
from boto3 import client, session
from boto3 import client
from moto import mock_cloudtrail, mock_iam, mock_s3
from prowler.providers.aws.lib.audit_info.models import AWS_Audit_Info
from prowler.providers.aws.services.cloudtrail.cloudtrail_service import Cloudtrail
from prowler.providers.aws.services.s3.s3_service import S3
from prowler.providers.common.models import Audit_Metadata
from tests.providers.aws.audit_info_utils import (
AWS_REGION_EU_WEST_1,
set_mocked_aws_audit_info,
)
AWS_ACCOUNT_NUMBER = "123456789012"
# Mocking Backup Calls
make_api_call = botocore.client.BaseClient._make_api_call
class Test_cloudtrail_bucket_requires_mfa_delete:
def set_mocked_audit_info(self):
audit_info = AWS_Audit_Info(
session_config=None,
original_session=None,
audit_session=session.Session(
profile_name=None,
botocore_session=None,
),
audited_account=AWS_ACCOUNT_NUMBER,
audited_account_arn=f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root",
audited_user_id=None,
audited_partition="aws",
audited_identity_arn=None,
profile=None,
profile_region=None,
credentials=None,
assumed_role_info=None,
audited_regions=["us-east-1", "eu-west-1"],
organizations_metadata=None,
audit_resources=None,
mfa_enabled=False,
audit_metadata=Audit_Metadata(
services_scanned=0,
expected_checks=[],
completed_checks=0,
audit_progress=0,
),
)
return audit_info
@mock_cloudtrail
def test_no_trails(self):
current_audit_info = set_mocked_aws_audit_info([AWS_REGION_EU_WEST_1])
@@ -2,50 +2,16 @@ from datetime import datetime, timedelta, timezone
from re import search
from unittest import mock
from boto3 import client, session
from boto3 import client
from moto import mock_cloudtrail, mock_s3
from prowler.providers.aws.lib.audit_info.models import AWS_Audit_Info
from prowler.providers.common.models import Audit_Metadata
from tests.providers.aws.audit_info_utils import (
AWS_REGION_EU_WEST_1,
set_mocked_aws_audit_info,
)
AWS_ACCOUNT_NUMBER = "123456789012"
class Test_cloudtrail_cloudwatch_logging_enabled:
def set_mocked_audit_info(self):
audit_info = AWS_Audit_Info(
session_config=None,
original_session=None,
audit_session=session.Session(
profile_name=None,
botocore_session=None,
),
audited_account=AWS_ACCOUNT_NUMBER,
audited_account_arn=f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root",
audited_user_id=None,
audited_partition="aws",
audited_identity_arn=None,
profile=None,
profile_region=None,
credentials=None,
assumed_role_info=None,
audited_regions=["us-east-1", "eu-west-1"],
organizations_metadata=None,
audit_resources=None,
mfa_enabled=False,
audit_metadata=Audit_Metadata(
services_scanned=0,
expected_checks=[],
completed_checks=0,
audit_progress=0,
),
)
return audit_info
@mock_cloudtrail
@mock_s3
def test_no_trails(self):
@@ -1,50 +1,16 @@
from unittest import mock
from boto3 import client, session
from boto3 import client
from moto import mock_cloudtrail, mock_s3
from prowler.providers.aws.lib.audit_info.models import AWS_Audit_Info
from prowler.providers.aws.services.cloudtrail.cloudtrail_service import Cloudtrail
from prowler.providers.common.models import Audit_Metadata
from tests.providers.aws.audit_info_utils import (
AWS_REGION_EU_WEST_1,
set_mocked_aws_audit_info,
)
AWS_ACCOUNT_NUMBER = "123456789012"
class Test_cloudtrail_insights_exist:
def set_mocked_audit_info(self):
audit_info = AWS_Audit_Info(
session_config=None,
original_session=None,
audit_session=session.Session(
profile_name=None,
botocore_session=None,
),
audited_account=AWS_ACCOUNT_NUMBER,
audited_account_arn=f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root",
audited_user_id=None,
audited_partition="aws",
audited_identity_arn=None,
profile=None,
profile_region=None,
credentials=None,
assumed_role_info=None,
audited_regions=["us-east-1", "eu-west-1"],
organizations_metadata=None,
audit_resources=None,
mfa_enabled=False,
audit_metadata=Audit_Metadata(
services_scanned=0,
expected_checks=[],
completed_checks=0,
audit_progress=0,
),
)
return audit_info
@mock_cloudtrail
def test_no_trails(self):
current_audit_info = set_mocked_aws_audit_info([AWS_REGION_EU_WEST_1])
@@ -1,50 +1,16 @@
from re import search
from unittest import mock
from boto3 import client, session
from boto3 import client
from moto import mock_cloudtrail, mock_kms, mock_s3
from prowler.providers.aws.lib.audit_info.models import AWS_Audit_Info
from prowler.providers.common.models import Audit_Metadata
from tests.providers.aws.audit_info_utils import (
AWS_REGION_EU_WEST_1,
set_mocked_aws_audit_info,
)
AWS_ACCOUNT_NUMBER = "123456789012"
class Test_cloudtrail_kms_encryption_enabled:
def set_mocked_audit_info(self):
audit_info = AWS_Audit_Info(
session_config=None,
original_session=None,
audit_session=session.Session(
profile_name=None,
botocore_session=None,
),
audited_account=AWS_ACCOUNT_NUMBER,
audited_account_arn=f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root",
audited_user_id=None,
audited_partition="aws",
audited_identity_arn=None,
profile=None,
profile_region=None,
credentials=None,
assumed_role_info=None,
audited_regions=["us-east-1", "eu-west-1"],
organizations_metadata=None,
audit_resources=None,
mfa_enabled=False,
audit_metadata=Audit_Metadata(
services_scanned=0,
expected_checks=[],
completed_checks=0,
audit_progress=0,
),
)
return audit_info
@mock_cloudtrail
@mock_s3
def test_no_trails(self):
@@ -1,50 +1,16 @@
from re import search
from unittest import mock
from boto3 import client, session
from boto3 import client
from moto import mock_cloudtrail, mock_s3
from prowler.providers.aws.lib.audit_info.models import AWS_Audit_Info
from prowler.providers.common.models import Audit_Metadata
from tests.providers.aws.audit_info_utils import (
AWS_REGION_EU_WEST_1,
set_mocked_aws_audit_info,
)
AWS_ACCOUNT_NUMBER = "123456789012"
class Test_cloudtrail_log_file_validation_enabled:
def set_mocked_audit_info(self):
audit_info = AWS_Audit_Info(
session_config=None,
original_session=None,
audit_session=session.Session(
profile_name=None,
botocore_session=None,
),
audited_account=AWS_ACCOUNT_NUMBER,
audited_account_arn=f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root",
audited_user_id=None,
audited_partition="aws",
audited_identity_arn=None,
profile=None,
profile_region=None,
credentials=None,
assumed_role_info=None,
audited_regions=["us-east-1", "eu-west-1"],
organizations_metadata=None,
audit_resources=None,
mfa_enabled=False,
audit_metadata=Audit_Metadata(
services_scanned=0,
expected_checks=[],
completed_checks=0,
audit_progress=0,
),
)
return audit_info
@mock_cloudtrail
@mock_s3
def test_no_trails(self):
@@ -1,50 +1,16 @@
from re import search
from unittest import mock
from boto3 import client, session
from boto3 import client
from moto import mock_cloudtrail, mock_s3
from prowler.providers.aws.lib.audit_info.models import AWS_Audit_Info
from prowler.providers.common.models import Audit_Metadata
from tests.providers.aws.audit_info_utils import (
AWS_REGION_EU_WEST_1,
set_mocked_aws_audit_info,
)
AWS_ACCOUNT_NUMBER = "123456789012"
class Test_cloudtrail_logs_s3_bucket_access_logging_enabled:
def set_mocked_audit_info(self):
audit_info = AWS_Audit_Info(
session_config=None,
original_session=None,
audit_session=session.Session(
profile_name=None,
botocore_session=None,
),
audited_account=AWS_ACCOUNT_NUMBER,
audited_account_arn=f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root",
audited_user_id=None,
audited_partition="aws",
audited_identity_arn=None,
profile=None,
profile_region=None,
credentials=None,
assumed_role_info=None,
audited_regions=["us-east-1", "eu-west-1"],
organizations_metadata=None,
audit_resources=None,
mfa_enabled=False,
audit_metadata=Audit_Metadata(
services_scanned=0,
expected_checks=[],
completed_checks=0,
audit_progress=0,
),
)
return audit_info
@mock_cloudtrail
@mock_s3
def test_no_trails(self):
@@ -1,50 +1,16 @@
from re import search
from unittest import mock
from boto3 import client, session
from boto3 import client
from moto import mock_cloudtrail, mock_s3
from prowler.providers.aws.lib.audit_info.models import AWS_Audit_Info
from prowler.providers.common.models import Audit_Metadata
from tests.providers.aws.audit_info_utils import (
AWS_REGION_EU_WEST_1,
set_mocked_aws_audit_info,
)
AWS_ACCOUNT_NUMBER = "123456789012"
class Test_cloudtrail_logs_s3_bucket_is_not_publicly_accessible:
def set_mocked_audit_info(self):
audit_info = AWS_Audit_Info(
session_config=None,
original_session=None,
audit_session=session.Session(
profile_name=None,
botocore_session=None,
),
audited_account=AWS_ACCOUNT_NUMBER,
audited_account_arn=f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root",
audited_user_id=None,
audited_partition="aws",
audited_identity_arn=None,
profile=None,
profile_region=None,
credentials=None,
assumed_role_info=None,
audited_regions=["us-east-1", "eu-west-1"],
organizations_metadata=None,
audit_resources=None,
mfa_enabled=False,
audit_metadata=Audit_Metadata(
services_scanned=0,
expected_checks=[],
completed_checks=0,
audit_progress=0,
),
)
return audit_info
@mock_cloudtrail
@mock_s3
def test_not_trails(self):
@@ -1,51 +1,19 @@
from re import search
from unittest import mock
from boto3 import client, session
from boto3 import client
from moto import mock_cloudtrail, mock_s3
from prowler.providers.aws.lib.audit_info.models import AWS_Audit_Info
from prowler.providers.common.models import Audit_Metadata
from tests.providers.aws.audit_info_utils import (
AWS_ACCOUNT_NUMBER,
AWS_REGION_EU_WEST_1,
set_mocked_aws_audit_info,
)
AWS_ACCOUNT_NUMBER = "123456789012"
AWS_REGION_US_EAST_1 = "us-east-1"
class Test_cloudtrail_multi_region_enabled:
def set_mocked_audit_info(self):
audit_info = AWS_Audit_Info(
session_config=None,
original_session=None,
audit_session=session.Session(
profile_name=None,
botocore_session=None,
),
audited_account=AWS_ACCOUNT_NUMBER,
audited_account_arn=f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root",
audited_user_id=None,
audited_partition="aws",
audited_identity_arn=None,
profile=None,
profile_region=None,
credentials=None,
assumed_role_info=None,
audited_regions=[AWS_REGION_US_EAST_1, AWS_REGION_EU_WEST_1],
organizations_metadata=None,
audit_resources=None,
mfa_enabled=False,
audit_metadata=Audit_Metadata(
services_scanned=0,
expected_checks=[],
completed_checks=0,
audit_progress=0,
),
)
return audit_info
@mock_cloudtrail
def test_no_trails(self):
from prowler.providers.aws.services.cloudtrail.cloudtrail_service import (
@@ -1,51 +1,18 @@
from unittest import mock
from boto3 import client, session
from boto3 import client
from moto import mock_cloudtrail, mock_s3
from prowler.providers.aws.lib.audit_info.models import AWS_Audit_Info
from prowler.providers.common.models import Audit_Metadata
from tests.providers.aws.audit_info_utils import (
AWS_ACCOUNT_NUMBER,
AWS_REGION_EU_WEST_1,
set_mocked_aws_audit_info,
)
AWS_ACCOUNT_NUMBER = "123456789012"
AWS_ACCOUNT_ARN = f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root"
AWS_REGION = "us-east-1"
class Test_cloudtrail_multi_region_enabled_logging_management_events:
def set_mocked_audit_info(self):
audit_info = AWS_Audit_Info(
session_config=None,
original_session=None,
audit_session=session.Session(
profile_name=None,
botocore_session=None,
),
audited_account=AWS_ACCOUNT_NUMBER,
audited_account_arn=AWS_ACCOUNT_ARN,
audited_user_id=None,
audited_partition="aws",
audited_identity_arn=None,
profile=None,
profile_region=None,
credentials=None,
assumed_role_info=None,
audited_regions=[AWS_REGION],
organizations_metadata=None,
audit_resources=None,
mfa_enabled=False,
audit_metadata=Audit_Metadata(
services_scanned=0,
expected_checks=[],
completed_checks=0,
audit_progress=0,
),
)
return audit_info
@mock_cloudtrail
def test_no_trails(self):
from prowler.providers.aws.services.cloudtrail.cloudtrail_service import (
@@ -72,7 +39,7 @@ class Test_cloudtrail_multi_region_enabled_logging_management_events:
assert len(result) == 1
assert result[0].resource_id == AWS_ACCOUNT_NUMBER
assert result[0].resource_arn == AWS_ACCOUNT_ARN
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].status == "FAIL"
assert (
result[0].status_extended
@@ -82,8 +49,10 @@ class Test_cloudtrail_multi_region_enabled_logging_management_events:
@mock_cloudtrail
@mock_s3
def test_compliant_trail_advanced_event_selector(self):
cloudtrail_client_us_east_1 = client("cloudtrail", region_name=AWS_REGION)
s3_client_us_east_1 = client("s3", region_name=AWS_REGION)
cloudtrail_client_us_east_1 = client(
"cloudtrail", region_name=AWS_REGION_EU_WEST_1
)
s3_client_us_east_1 = client("s3", region_name=AWS_REGION_EU_WEST_1)
trail_name_us = "trail_test_us"
bucket_name_us = "bucket_test_us"
s3_client_us_east_1.create_bucket(Bucket=bucket_name_us)
@@ -127,18 +96,20 @@ class Test_cloudtrail_multi_region_enabled_logging_management_events:
assert len(result) == 1
assert result[0].resource_id == trail_name_us
assert result[0].resource_arn == trail_us["TrailARN"]
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Trail {trail_name_us} from home region {AWS_REGION} is multi-region, is logging and have management events enabled."
== f"Trail {trail_name_us} from home region {AWS_REGION_EU_WEST_1} is multi-region, is logging and have management events enabled."
)
@mock_cloudtrail
@mock_s3
def test_non_compliant_trail_advanced_event_selector(self):
cloudtrail_client_us_east_1 = client("cloudtrail", region_name=AWS_REGION)
s3_client_us_east_1 = client("s3", region_name=AWS_REGION)
cloudtrail_client_us_east_1 = client(
"cloudtrail", region_name=AWS_REGION_EU_WEST_1
)
s3_client_us_east_1 = client("s3", region_name=AWS_REGION_EU_WEST_1)
trail_name_us = "trail_test_us"
bucket_name_us = "bucket_test_us"
s3_client_us_east_1.create_bucket(Bucket=bucket_name_us)
@@ -182,7 +153,7 @@ class Test_cloudtrail_multi_region_enabled_logging_management_events:
result = check.execute()
assert result[0].resource_id == AWS_ACCOUNT_NUMBER
assert result[0].resource_arn == AWS_ACCOUNT_ARN
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].status == "FAIL"
assert (
result[0].status_extended
@@ -192,8 +163,10 @@ class Test_cloudtrail_multi_region_enabled_logging_management_events:
@mock_cloudtrail
@mock_s3
def test_compliant_trail_classic_event_selector(self):
cloudtrail_client_us_east_1 = client("cloudtrail", region_name=AWS_REGION)
s3_client_us_east_1 = client("s3", region_name=AWS_REGION)
cloudtrail_client_us_east_1 = client(
"cloudtrail", region_name=AWS_REGION_EU_WEST_1
)
s3_client_us_east_1 = client("s3", region_name=AWS_REGION_EU_WEST_1)
trail_name_us = "trail_test_us"
bucket_name_us = "bucket_test_us"
s3_client_us_east_1.create_bucket(Bucket=bucket_name_us)
@@ -236,18 +209,20 @@ class Test_cloudtrail_multi_region_enabled_logging_management_events:
assert len(result) == 1
assert result[0].resource_id == trail_name_us
assert result[0].resource_arn == trail_us["TrailARN"]
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].status == "PASS"
assert (
result[0].status_extended
== f"Trail {trail_name_us} from home region {AWS_REGION} is multi-region, is logging and have management events enabled."
== f"Trail {trail_name_us} from home region {AWS_REGION_EU_WEST_1} is multi-region, is logging and have management events enabled."
)
@mock_cloudtrail
@mock_s3
def test_non_compliant_trail_classic_event_selector(self):
cloudtrail_client_us_east_1 = client("cloudtrail", region_name=AWS_REGION)
s3_client_us_east_1 = client("s3", region_name=AWS_REGION)
cloudtrail_client_us_east_1 = client(
"cloudtrail", region_name=AWS_REGION_EU_WEST_1
)
s3_client_us_east_1 = client("s3", region_name=AWS_REGION_EU_WEST_1)
trail_name_us = "trail_test_us"
bucket_name_us = "bucket_test_us"
s3_client_us_east_1.create_bucket(Bucket=bucket_name_us)
@@ -289,7 +264,7 @@ class Test_cloudtrail_multi_region_enabled_logging_management_events:
result = check.execute()
assert result[0].resource_id == AWS_ACCOUNT_NUMBER
assert result[0].resource_arn == AWS_ACCOUNT_ARN
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].status == "FAIL"
assert (
result[0].status_extended
@@ -1,48 +1,15 @@
from boto3 import client, session
from boto3 import client
from moto import mock_cloudtrail, mock_s3
from prowler.providers.aws.lib.audit_info.models import AWS_Audit_Info
from prowler.providers.aws.services.cloudtrail.cloudtrail_service import Cloudtrail
from prowler.providers.common.models import Audit_Metadata
from tests.providers.aws.audit_info_utils import (
AWS_ACCOUNT_NUMBER,
AWS_REGION_EU_WEST_1,
set_mocked_aws_audit_info,
)
AWS_ACCOUNT_NUMBER = "123456789012"
class Test_Cloudtrail_Service:
def set_mocked_audit_info(self):
audit_info = AWS_Audit_Info(
session_config=None,
original_session=None,
audit_session=session.Session(
profile_name=None,
botocore_session=None,
),
audited_account=AWS_ACCOUNT_NUMBER,
audited_account_arn=f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root",
audited_user_id=None,
audited_partition="aws",
audited_identity_arn=None,
profile=None,
profile_region=None,
credentials=None,
assumed_role_info=None,
audited_regions=["eu-west-1", "us-east-1"],
organizations_metadata=None,
audit_resources=None,
mfa_enabled=False,
audit_metadata=Audit_Metadata(
services_scanned=0,
expected_checks=[],
completed_checks=0,
audit_progress=0,
),
)
return audit_info
# Test Cloudtrail Service
@mock_cloudtrail
def test_service(self):
@@ -9,9 +9,6 @@ from tests.providers.aws.audit_info_utils import (
set_mocked_aws_audit_info,
)
AWS_REGION = "us-east-1"
AWS_ACCOUNT_NUMBER = "123456789012"
class Test_cloudwatch_changes_to_network_acls_alarm_configured:
@mock_logs
@@ -72,8 +69,8 @@ class Test_cloudwatch_changes_to_network_acls_alarm_configured:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_no_log_group(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
cloudtrail_client.create_trail(Name="test_trail", S3BucketName="test")
@@ -131,15 +128,15 @@ class Test_cloudwatch_changes_to_network_acls_alarm_configured:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
from prowler.providers.aws.services.cloudtrail.cloudtrail_service import (
@@ -196,15 +193,15 @@ class Test_cloudwatch_changes_to_network_acls_alarm_configured:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -273,16 +270,16 @@ class Test_cloudwatch_changes_to_network_acls_alarm_configured:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -362,16 +359,16 @@ class Test_cloudwatch_changes_to_network_acls_alarm_configured:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_with_quotes(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -451,16 +448,16 @@ class Test_cloudwatch_changes_to_network_acls_alarm_configured:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_with_newlines(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -9,9 +9,6 @@ from tests.providers.aws.audit_info_utils import (
set_mocked_aws_audit_info,
)
AWS_REGION = "us-east-1"
AWS_ACCOUNT_NUMBER = "123456789012"
class Test_cloudwatch_changes_to_network_gateways_alarm_configured:
@mock_logs
@@ -72,8 +69,8 @@ class Test_cloudwatch_changes_to_network_gateways_alarm_configured:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_no_log_group(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
cloudtrail_client.create_trail(Name="test_trail", S3BucketName="test")
@@ -131,15 +128,15 @@ class Test_cloudwatch_changes_to_network_gateways_alarm_configured:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
from prowler.providers.aws.services.cloudtrail.cloudtrail_service import (
@@ -196,15 +193,15 @@ class Test_cloudwatch_changes_to_network_gateways_alarm_configured:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -273,16 +270,16 @@ class Test_cloudwatch_changes_to_network_gateways_alarm_configured:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -362,16 +359,16 @@ class Test_cloudwatch_changes_to_network_gateways_alarm_configured:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_with_quotes(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -451,16 +448,16 @@ class Test_cloudwatch_changes_to_network_gateways_alarm_configured:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_with_newlines(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -9,9 +9,6 @@ from tests.providers.aws.audit_info_utils import (
set_mocked_aws_audit_info,
)
AWS_REGION = "us-east-1"
AWS_ACCOUNT_NUMBER = "123456789012"
class Test_cloudwatch_changes_to_network_route_tables_alarm_configured:
@mock_logs
@@ -72,8 +69,8 @@ class Test_cloudwatch_changes_to_network_route_tables_alarm_configured:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_no_log_group(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
cloudtrail_client.create_trail(Name="test_trail", S3BucketName="test")
@@ -131,15 +128,15 @@ class Test_cloudwatch_changes_to_network_route_tables_alarm_configured:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
from prowler.providers.aws.services.cloudtrail.cloudtrail_service import (
@@ -196,15 +193,15 @@ class Test_cloudwatch_changes_to_network_route_tables_alarm_configured:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -273,16 +270,16 @@ class Test_cloudwatch_changes_to_network_route_tables_alarm_configured:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -362,16 +359,16 @@ class Test_cloudwatch_changes_to_network_route_tables_alarm_configured:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_with_quotes(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -451,16 +448,16 @@ class Test_cloudwatch_changes_to_network_route_tables_alarm_configured:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_with_newlines(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -9,9 +9,6 @@ from tests.providers.aws.audit_info_utils import (
set_mocked_aws_audit_info,
)
AWS_REGION = "us-east-1"
AWS_ACCOUNT_NUMBER = "123456789012"
class Test_cloudwatch_changes_to_vpcs_alarm_configured:
@mock_logs
@@ -72,8 +69,8 @@ class Test_cloudwatch_changes_to_vpcs_alarm_configured:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_no_log_group(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
cloudtrail_client.create_trail(Name="test_trail", S3BucketName="test")
@@ -131,15 +128,15 @@ class Test_cloudwatch_changes_to_vpcs_alarm_configured:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
from prowler.providers.aws.services.cloudtrail.cloudtrail_service import (
@@ -196,15 +193,15 @@ class Test_cloudwatch_changes_to_vpcs_alarm_configured:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -273,16 +270,16 @@ class Test_cloudwatch_changes_to_vpcs_alarm_configured:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -362,16 +359,16 @@ class Test_cloudwatch_changes_to_vpcs_alarm_configured:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_with_quotes(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -451,16 +448,16 @@ class Test_cloudwatch_changes_to_vpcs_alarm_configured:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_with_newlines(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -4,13 +4,11 @@ from boto3 import client
from moto import mock_iam
from tests.providers.aws.audit_info_utils import (
AWS_ACCOUNT_NUMBER,
AWS_REGION_EU_WEST_1,
set_mocked_aws_audit_info,
)
AWS_REGION = "us-east-1"
AWS_ACCOUNT_NUMBER = "123456789012"
class Test_cloudwatch_cross_account_sharing_disabled:
@mock_iam
@@ -55,7 +53,7 @@ class Test_cloudwatch_cross_account_sharing_disabled:
@mock_iam
def test_cloudwatch_log_group_with_cross_account_role(self):
# Generate Logs Client
iam_client = client("iam", region_name=AWS_REGION)
iam_client = client("iam", region_name=AWS_REGION_EU_WEST_1)
# Request Logs group
iam_client.create_role(
RoleName="CloudWatch-CrossAccountSharingRole", AssumeRolePolicyDocument="{}"
@@ -8,9 +8,6 @@ from tests.providers.aws.audit_info_utils import (
set_mocked_aws_audit_info,
)
AWS_REGION = "us-east-1"
AWS_ACCOUNT_NUMBER = "123456789012"
class Test_cloudwatch_log_group_kms_encryption_enabled:
def test_cloudwatch_no_log_groups(self):
@@ -48,7 +45,7 @@ class Test_cloudwatch_log_group_kms_encryption_enabled:
@mock_logs
def test_cloudwatch_log_group_without_kms_key(self):
# Generate Logs Client
logs_client = client("logs", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
# Request Logs group
logs_client.create_log_group(
logGroupName="test",
@@ -94,7 +91,7 @@ class Test_cloudwatch_log_group_kms_encryption_enabled:
@mock_logs
def test_cloudwatch_log_group_with_kms_key(self):
# Generate Logs Client
logs_client = client("logs", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
# Request Logs group
logs_client.create_log_group(logGroupName="test", kmsKeyId="test_kms_id")
@@ -10,9 +10,6 @@ from tests.providers.aws.audit_info_utils import (
set_mocked_aws_audit_info,
)
AWS_REGION = "us-east-1"
AWS_ACCOUNT_NUMBER = "123456789012"
class Test_cloudwatch_log_group_no_secrets_in_logs:
def test_cloudwatch_no_log_groups(self):
@@ -50,7 +47,7 @@ class Test_cloudwatch_log_group_no_secrets_in_logs:
@mock_logs
def test_cloudwatch_log_group_without_secrets(self):
# Generate Logs Client
logs_client = client("logs", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
# Request Logs group
logs_client.create_log_group(logGroupName="test")
logs_client.create_log_stream(logGroupName="test", logStreamName="test stream")
@@ -101,7 +98,7 @@ class Test_cloudwatch_log_group_no_secrets_in_logs:
@mock_logs
def test_cloudwatch_log_group_with_secrets(self):
# Generate Logs Client
logs_client = client("logs", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
# Request Logs group
logs_client.create_log_group(logGroupName="test")
logs_client.create_log_stream(logGroupName="test", logStreamName="test stream")
@@ -4,13 +4,11 @@ from boto3 import client
from moto import mock_logs
from tests.providers.aws.audit_info_utils import (
AWS_ACCOUNT_NUMBER,
AWS_REGION_EU_WEST_1,
set_mocked_aws_audit_info,
)
AWS_REGION = "us-east-1"
AWS_ACCOUNT_NUMBER = "123456789012"
class Test_cloudwatch_log_group_retention_policy_specific_days_enabled:
def test_cloudwatch_no_log_groups(self):
@@ -49,7 +47,7 @@ class Test_cloudwatch_log_group_retention_policy_specific_days_enabled:
@mock_logs
def test_cloudwatch_log_group_without_retention_days_never_expires(self):
# Generate Logs Client
logs_client = client("logs", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
# Request Logs group
logs_client.create_log_group(
logGroupName="test",
@@ -93,14 +91,14 @@ class Test_cloudwatch_log_group_retention_policy_specific_days_enabled:
assert result[0].resource_id == "test"
assert (
result[0].resource_arn
== f"arn:aws:logs:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:log-group:test"
== f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:log-group:test"
)
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
@mock_logs
def test_cloudwatch_log_group_with_compliant_retention_days(self):
# Generate Logs Client
logs_client = client("logs", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
# Request Logs group
logs_client.create_log_group(
logGroupName="test",
@@ -145,14 +143,14 @@ class Test_cloudwatch_log_group_retention_policy_specific_days_enabled:
assert result[0].resource_id == "test"
assert (
result[0].resource_arn
== f"arn:aws:logs:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:log-group:test"
== f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:log-group:test"
)
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
@mock_logs
def test_cloudwatch_log_group_with_no_compliant_retention_days(self):
# Generate Logs Client
logs_client = client("logs", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
# Request Logs group
logs_client.create_log_group(
logGroupName="test",
@@ -197,6 +195,6 @@ class Test_cloudwatch_log_group_retention_policy_specific_days_enabled:
assert result[0].resource_id == "test"
assert (
result[0].resource_arn
== f"arn:aws:logs:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:log-group:test"
== f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:log-group:test"
)
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
@@ -9,9 +9,6 @@ from tests.providers.aws.audit_info_utils import (
set_mocked_aws_audit_info,
)
AWS_REGION = "us-east-1"
AWS_ACCOUNT_NUMBER = "123456789012"
class Test_cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_changes_enabled:
@mock_logs
@@ -74,8 +71,8 @@ class Test_cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_c
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_no_log_group(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
cloudtrail_client.create_trail(Name="test_trail", S3BucketName="test")
@@ -135,15 +132,15 @@ class Test_cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_c
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
from prowler.providers.aws.services.cloudtrail.cloudtrail_service import (
@@ -202,15 +199,15 @@ class Test_cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_c
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -281,16 +278,16 @@ class Test_cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_c
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -372,16 +369,16 @@ class Test_cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_c
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_with_quotes(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -463,16 +460,16 @@ class Test_cloudwatch_log_metric_filter_and_alarm_for_aws_config_configuration_c
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_with_newlines(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -9,9 +9,6 @@ from tests.providers.aws.audit_info_utils import (
set_mocked_aws_audit_info,
)
AWS_REGION = "us-east-1"
AWS_ACCOUNT_NUMBER = "123456789012"
class Test_cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_changes_enabled:
@mock_logs
@@ -74,8 +71,8 @@ class Test_cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_c
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_no_log_group(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
cloudtrail_client.create_trail(Name="test_trail", S3BucketName="test")
@@ -135,15 +132,15 @@ class Test_cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_c
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
from prowler.providers.aws.services.cloudtrail.cloudtrail_service import (
@@ -202,15 +199,15 @@ class Test_cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_c
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -281,16 +278,16 @@ class Test_cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_c
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -372,16 +369,16 @@ class Test_cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_c
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_with_quotes(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -463,16 +460,16 @@ class Test_cloudwatch_log_metric_filter_and_alarm_for_cloudtrail_configuration_c
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_with_newlines(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -9,9 +9,6 @@ from tests.providers.aws.audit_info_utils import (
set_mocked_aws_audit_info,
)
AWS_REGION = "us-east-1"
AWS_ACCOUNT_NUMBER = "123456789012"
class Test_cloudwatch_log_metric_filter_authentication_failures:
@mock_logs
@@ -72,8 +69,8 @@ class Test_cloudwatch_log_metric_filter_authentication_failures:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_no_log_group(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
cloudtrail_client.create_trail(Name="test_trail", S3BucketName="test")
@@ -131,15 +128,15 @@ class Test_cloudwatch_log_metric_filter_authentication_failures:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
from prowler.providers.aws.services.cloudtrail.cloudtrail_service import (
@@ -196,15 +193,15 @@ class Test_cloudwatch_log_metric_filter_authentication_failures:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -273,16 +270,16 @@ class Test_cloudwatch_log_metric_filter_authentication_failures:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -362,16 +359,16 @@ class Test_cloudwatch_log_metric_filter_authentication_failures:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_with_quotes(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -451,16 +448,16 @@ class Test_cloudwatch_log_metric_filter_authentication_failures:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_with_newlines(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -9,9 +9,6 @@ from tests.providers.aws.audit_info_utils import (
set_mocked_aws_audit_info,
)
AWS_REGION = "us-east-1"
AWS_ACCOUNT_NUMBER = "123456789012"
class Test_cloudwatch_log_metric_filter_aws_organizations_changes:
@mock_logs
@@ -72,8 +69,8 @@ class Test_cloudwatch_log_metric_filter_aws_organizations_changes:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_no_log_group(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
cloudtrail_client.create_trail(Name="test_trail", S3BucketName="test")
@@ -131,15 +128,15 @@ class Test_cloudwatch_log_metric_filter_aws_organizations_changes:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
from prowler.providers.aws.services.cloudtrail.cloudtrail_service import (
@@ -196,15 +193,15 @@ class Test_cloudwatch_log_metric_filter_aws_organizations_changes:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -273,16 +270,16 @@ class Test_cloudwatch_log_metric_filter_aws_organizations_changes:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -362,16 +359,16 @@ class Test_cloudwatch_log_metric_filter_aws_organizations_changes:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_with_quotes(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -451,16 +448,16 @@ class Test_cloudwatch_log_metric_filter_aws_organizations_changes:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_with_newlines(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -9,9 +9,6 @@ from tests.providers.aws.audit_info_utils import (
set_mocked_aws_audit_info,
)
AWS_REGION = "us-east-1"
AWS_ACCOUNT_NUMBER = "123456789012"
class Test_cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk:
@mock_logs
@@ -74,8 +71,8 @@ class Test_cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_no_log_group(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
cloudtrail_client.create_trail(Name="test_trail", S3BucketName="test")
@@ -135,15 +132,15 @@ class Test_cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
from prowler.providers.aws.services.cloudtrail.cloudtrail_service import (
@@ -202,15 +199,15 @@ class Test_cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -281,16 +278,16 @@ class Test_cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -372,16 +369,16 @@ class Test_cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_with_quotes(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -463,16 +460,16 @@ class Test_cloudwatch_log_metric_filter_disable_or_scheduled_deletion_of_kms_cmk
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_with_newlines(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -9,9 +9,6 @@ from tests.providers.aws.audit_info_utils import (
set_mocked_aws_audit_info,
)
AWS_REGION = "us-east-1"
AWS_ACCOUNT_NUMBER = "123456789012"
class Test_cloudwatch_log_metric_filter_for_s3_bucket_policy_changes:
@mock_logs
@@ -72,8 +69,8 @@ class Test_cloudwatch_log_metric_filter_for_s3_bucket_policy_changes:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_no_log_group(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
cloudtrail_client.create_trail(Name="test_trail", S3BucketName="test")
@@ -131,15 +128,15 @@ class Test_cloudwatch_log_metric_filter_for_s3_bucket_policy_changes:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
from prowler.providers.aws.services.cloudtrail.cloudtrail_service import (
@@ -196,15 +193,15 @@ class Test_cloudwatch_log_metric_filter_for_s3_bucket_policy_changes:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -273,16 +270,16 @@ class Test_cloudwatch_log_metric_filter_for_s3_bucket_policy_changes:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -362,16 +359,16 @@ class Test_cloudwatch_log_metric_filter_for_s3_bucket_policy_changes:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_with_quotes(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -451,16 +448,16 @@ class Test_cloudwatch_log_metric_filter_for_s3_bucket_policy_changes:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_with_newlines(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -9,9 +9,6 @@ from tests.providers.aws.audit_info_utils import (
set_mocked_aws_audit_info,
)
AWS_REGION = "us-east-1"
AWS_ACCOUNT_NUMBER = "123456789012"
class Test_cloudwatch_log_metric_filter_unauthorized_api_calls:
@mock_logs
@@ -72,8 +69,8 @@ class Test_cloudwatch_log_metric_filter_unauthorized_api_calls:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_no_log_group(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
cloudtrail_client.create_trail(Name="test_trail", S3BucketName="test")
@@ -131,15 +128,15 @@ class Test_cloudwatch_log_metric_filter_unauthorized_api_calls:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
from prowler.providers.aws.services.cloudtrail.cloudtrail_service import (
@@ -196,15 +193,15 @@ class Test_cloudwatch_log_metric_filter_unauthorized_api_calls:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -273,16 +270,16 @@ class Test_cloudwatch_log_metric_filter_unauthorized_api_calls:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -362,16 +359,16 @@ class Test_cloudwatch_log_metric_filter_unauthorized_api_calls:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_with_quotes(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -451,16 +448,16 @@ class Test_cloudwatch_log_metric_filter_unauthorized_api_calls:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_with_newlines(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -9,9 +9,6 @@ from tests.providers.aws.audit_info_utils import (
set_mocked_aws_audit_info,
)
AWS_REGION = "us-east-1"
AWS_ACCOUNT_NUMBER = "123456789012"
class Test_cloudwatch_log_metric_filter_root_usage:
@mock_logs
@@ -72,8 +69,8 @@ class Test_cloudwatch_log_metric_filter_root_usage:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_no_log_group(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
cloudtrail_client.create_trail(Name="test_trail", S3BucketName="test")
@@ -131,15 +128,15 @@ class Test_cloudwatch_log_metric_filter_root_usage:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
from prowler.providers.aws.services.cloudtrail.cloudtrail_service import (
@@ -196,15 +193,15 @@ class Test_cloudwatch_log_metric_filter_root_usage:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -273,16 +270,16 @@ class Test_cloudwatch_log_metric_filter_root_usage:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -362,16 +359,16 @@ class Test_cloudwatch_log_metric_filter_root_usage:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_with_quotes(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -451,16 +448,16 @@ class Test_cloudwatch_log_metric_filter_root_usage:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_with_newlines(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -9,9 +9,6 @@ from tests.providers.aws.audit_info_utils import (
set_mocked_aws_audit_info,
)
AWS_REGION = "us-east-1"
AWS_ACCOUNT_NUMBER = "123456789012"
class Test_cloudwatch_log_metric_filter_unauthorized_api_calls:
@mock_logs
@@ -72,8 +69,8 @@ class Test_cloudwatch_log_metric_filter_unauthorized_api_calls:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_no_log_group(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
cloudtrail_client.create_trail(Name="test_trail", S3BucketName="test")
@@ -131,15 +128,15 @@ class Test_cloudwatch_log_metric_filter_unauthorized_api_calls:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
from prowler.providers.aws.services.cloudtrail.cloudtrail_service import (
@@ -196,15 +193,15 @@ class Test_cloudwatch_log_metric_filter_unauthorized_api_calls:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -273,16 +270,16 @@ class Test_cloudwatch_log_metric_filter_unauthorized_api_calls:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -362,16 +359,16 @@ class Test_cloudwatch_log_metric_filter_unauthorized_api_calls:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_with_quotes(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -451,16 +448,16 @@ class Test_cloudwatch_log_metric_filter_unauthorized_api_calls:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_with_newlines(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -9,9 +9,6 @@ from tests.providers.aws.audit_info_utils import (
set_mocked_aws_audit_info,
)
AWS_REGION = "us-east-1"
AWS_ACCOUNT_NUMBER = "123456789012"
class Test_cloudwatch_log_metric_filter_sign_in_without_mfa:
@mock_logs
@@ -72,8 +69,8 @@ class Test_cloudwatch_log_metric_filter_sign_in_without_mfa:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_no_log_group(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
cloudtrail_client.create_trail(Name="test_trail", S3BucketName="test")
@@ -131,15 +128,15 @@ class Test_cloudwatch_log_metric_filter_sign_in_without_mfa:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
from prowler.providers.aws.services.cloudtrail.cloudtrail_service import (
@@ -196,15 +193,15 @@ class Test_cloudwatch_log_metric_filter_sign_in_without_mfa:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -273,16 +270,16 @@ class Test_cloudwatch_log_metric_filter_sign_in_without_mfa:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -362,16 +359,16 @@ class Test_cloudwatch_log_metric_filter_sign_in_without_mfa:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_with_quotes(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -451,16 +448,16 @@ class Test_cloudwatch_log_metric_filter_sign_in_without_mfa:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_with_newlines(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -9,9 +9,6 @@ from tests.providers.aws.audit_info_utils import (
set_mocked_aws_audit_info,
)
AWS_REGION = "us-east-1"
AWS_ACCOUNT_NUMBER = "123456789012"
class Test_cloudwatch_log_metric_filter_unauthorized_api_calls:
@mock_logs
@@ -72,8 +69,8 @@ class Test_cloudwatch_log_metric_filter_unauthorized_api_calls:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_no_log_group(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
cloudtrail_client.create_trail(Name="test_trail", S3BucketName="test")
@@ -131,15 +128,15 @@ class Test_cloudwatch_log_metric_filter_unauthorized_api_calls:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
from prowler.providers.aws.services.cloudtrail.cloudtrail_service import (
@@ -196,15 +193,15 @@ class Test_cloudwatch_log_metric_filter_unauthorized_api_calls:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -273,16 +270,16 @@ class Test_cloudwatch_log_metric_filter_unauthorized_api_calls:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -362,16 +359,16 @@ class Test_cloudwatch_log_metric_filter_unauthorized_api_calls:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_with_quotes(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -451,16 +448,16 @@ class Test_cloudwatch_log_metric_filter_unauthorized_api_calls:
@mock_cloudwatch
@mock_s3
def test_cloudwatch_trail_with_log_group_with_metric_and_alarm_with_newlines(self):
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION)
s3_client = client("s3", region_name=AWS_REGION)
cloudtrail_client = client("cloudtrail", region_name=AWS_REGION_EU_WEST_1)
cloudwatch_client = client("cloudwatch", region_name=AWS_REGION_EU_WEST_1)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
s3_client = client("s3", region_name=AWS_REGION_EU_WEST_1)
s3_client.create_bucket(Bucket="test")
logs_client.create_log_group(logGroupName="/log-group/test")
cloudtrail_client.create_trail(
Name="test_trail",
S3BucketName="test",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
CloudWatchLogsLogGroupArn=f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:log-group:/log-group/test:*",
)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
@@ -1,53 +1,18 @@
from boto3 import client, session
from boto3 import client
from moto import mock_cloudwatch, mock_logs
from prowler.providers.aws.lib.audit_info.models import AWS_Audit_Info
from prowler.providers.aws.services.cloudwatch.cloudwatch_service import (
CloudWatch,
Logs,
)
from prowler.providers.common.models import Audit_Metadata
from tests.providers.aws.audit_info_utils import (
AWS_ACCOUNT_NUMBER,
AWS_REGION_EU_WEST_1,
set_mocked_aws_audit_info,
)
AWS_ACCOUNT_NUMBER = "123456789012"
AWS_REGION = "us-east-1"
class Test_CloudWatch_Service:
def set_mocked_audit_info(self):
audit_info = AWS_Audit_Info(
session_config=None,
original_session=None,
audit_session=session.Session(
profile_name=None,
botocore_session=None,
),
audited_account=AWS_ACCOUNT_NUMBER,
audited_account_arn=f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root",
audited_user_id=None,
audited_partition="aws",
audited_identity_arn=None,
profile=None,
profile_region=None,
credentials=None,
assumed_role_info=None,
audited_regions=None,
organizations_metadata=None,
audit_resources=None,
mfa_enabled=False,
audit_metadata=Audit_Metadata(
services_scanned=0,
# We need to set this check to call __describe_log_groups__
expected_checks=["cloudwatch_log_group_no_secrets_in_logs"],
completed_checks=0,
audit_progress=0,
),
)
return audit_info
# Test CloudWatch Service
@mock_cloudwatch
def test_service(self):
@@ -118,7 +83,7 @@ class Test_CloudWatch_Service:
@mock_cloudwatch
def test__describe_alarms__(self):
# CloudWatch client for this test class
cw_client = client("cloudwatch", region_name=AWS_REGION)
cw_client = client("cloudwatch", region_name=AWS_REGION_EU_WEST_1)
cw_client.put_metric_alarm(
AlarmActions=["arn:alarm"],
AlarmDescription="A test",
@@ -141,12 +106,12 @@ class Test_CloudWatch_Service:
assert len(cloudwatch.metric_alarms) == 1
assert (
cloudwatch.metric_alarms[0].arn
== f"arn:aws:cloudwatch:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:alarm:test"
== f"arn:aws:cloudwatch:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:alarm:test"
)
assert cloudwatch.metric_alarms[0].name == "test"
assert cloudwatch.metric_alarms[0].metric == "test_metric"
assert cloudwatch.metric_alarms[0].name_space == "test_namespace"
assert cloudwatch.metric_alarms[0].region == AWS_REGION
assert cloudwatch.metric_alarms[0].region == AWS_REGION_EU_WEST_1
assert cloudwatch.metric_alarms[0].tags == [
{"Key": "key-1", "Value": "value-1"}
]
@@ -155,7 +120,7 @@ class Test_CloudWatch_Service:
@mock_logs
def test__describe_metric_filters__(self):
# Logs client for this test class
logs_client = client("logs", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
logs_client.put_metric_filter(
logGroupName="/log-group/test",
filterName="test-filter",
@@ -175,13 +140,13 @@ class Test_CloudWatch_Service:
assert logs.metric_filters[0].name == "test-filter"
assert logs.metric_filters[0].metric == "my-metric"
assert logs.metric_filters[0].pattern == "test-pattern"
assert logs.metric_filters[0].region == AWS_REGION
assert logs.metric_filters[0].region == AWS_REGION_EU_WEST_1
# Test Logs Filters
@mock_logs
def test__describe_log_groups__(self):
# Logs client for this test class
logs_client = client("logs", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
logs_client.create_log_group(
logGroupName="/log-group/test",
kmsKeyId="test_kms_id",
@@ -195,13 +160,13 @@ class Test_CloudWatch_Service:
assert len(logs.log_groups) == 1
assert (
logs.log_groups[0].arn
== f"arn:aws:logs:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test"
== f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test"
)
assert logs.log_groups[0].name == "/log-group/test"
assert logs.log_groups[0].retention_days == 400
assert logs.log_groups[0].kms_id == "test_kms_id"
assert not logs.log_groups[0].never_expire
assert logs.log_groups[0].region == AWS_REGION
assert logs.log_groups[0].region == AWS_REGION_EU_WEST_1
assert logs.log_groups[0].tags == [
{"tag_key_1": "tag_value_1", "tag_key_2": "tag_value_2"}
]
@@ -209,7 +174,7 @@ class Test_CloudWatch_Service:
@mock_logs
def test__describe_log_groups__never_expire(self):
# Logs client for this test class
logs_client = client("logs", region_name=AWS_REGION)
logs_client = client("logs", region_name=AWS_REGION_EU_WEST_1)
logs_client.create_log_group(
logGroupName="/log-group/test",
kmsKeyId="test_kms_id",
@@ -221,14 +186,14 @@ class Test_CloudWatch_Service:
assert len(logs.log_groups) == 1
assert (
logs.log_groups[0].arn
== f"arn:aws:logs:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test"
== f"arn:aws:logs:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:log-group:/log-group/test"
)
assert logs.log_groups[0].name == "/log-group/test"
assert logs.log_groups[0].never_expire
# Since it never expires we don't use the retention_days
assert logs.log_groups[0].retention_days == 9999
assert logs.log_groups[0].kms_id == "test_kms_id"
assert logs.log_groups[0].region == AWS_REGION
assert logs.log_groups[0].region == AWS_REGION_EU_WEST_1
assert logs.log_groups[0].tags == [
{"tag_key_1": "tag_value_1", "tag_key_2": "tag_value_2"}
]
@@ -13,8 +13,7 @@ from prowler.providers.aws.services.codeartifact.codeartifact_service import (
Restrictions,
RestrictionValues,
)
AWS_REGION = "eu-west-1"
from tests.providers.aws.audit_info_utils import AWS_REGION_EU_WEST_1
class Test_codeartifact_packages_external_public_publishing_disabled:
@@ -43,7 +42,7 @@ class Test_codeartifact_packages_external_public_publishing_disabled:
arn="",
domain_name="",
domain_owner="",
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
packages=[],
)
}
@@ -65,14 +64,14 @@ class Test_codeartifact_packages_external_public_publishing_disabled:
codeartifact_client = mock.MagicMock
package_name = "test-package"
package_namespace = "test-namespace"
repository_arn = f"arn:aws:codebuild:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:repository/test-repository"
repository_arn = f"arn:aws:codebuild:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:repository/test-repository"
codeartifact_client.repositories = {
"test-repository": Repository(
name="test-repository",
arn=repository_arn,
domain_name="",
domain_owner="",
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
packages=[
Package(
name=package_name,
@@ -108,7 +107,7 @@ class Test_codeartifact_packages_external_public_publishing_disabled:
result = check.execute()
assert len(result) == 1
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].resource_id == "test-package"
assert (
result[0].resource_arn
@@ -125,14 +124,14 @@ class Test_codeartifact_packages_external_public_publishing_disabled:
codeartifact_client = mock.MagicMock
package_name = "test-package"
package_namespace = "test-namespace"
repository_arn = f"arn:aws:codebuild:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:repository/test-repository"
repository_arn = f"arn:aws:codebuild:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:repository/test-repository"
codeartifact_client.repositories = {
"test-repository": Repository(
name="test-repository",
arn=repository_arn,
domain_name="",
domain_owner="",
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
packages=[
Package(
name=package_name,
@@ -168,7 +167,7 @@ class Test_codeartifact_packages_external_public_publishing_disabled:
result = check.execute()
assert len(result) == 1
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].resource_id == "test-package"
assert (
result[0].resource_arn
@@ -14,17 +14,10 @@ from tests.providers.aws.audit_info_utils import (
set_mocked_aws_audit_info,
)
# Mock Test Region
AWS_REGION = "eu-west-1"
AWS_ACCOUNT_NUMBER = "123456789012"
# Mocking Access Analyzer Calls
make_api_call = botocore.client.BaseClient._make_api_call
TEST_REPOSITORY_ARN = (
f"arn:aws:codebuild:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:repository/test-repository"
)
TEST_REPOSITORY_ARN = f"arn:aws:codebuild:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:repository/test-repository"
def mock_make_api_call(self, operation_name, kwarg):
@@ -93,9 +86,11 @@ def mock_make_api_call(self, operation_name, kwarg):
# Mock generate_regional_clients()
def mock_generate_regional_clients(service, audit_info, _):
regional_client = audit_info.audit_session.client(service, region_name=AWS_REGION)
regional_client.region = AWS_REGION
return {AWS_REGION: regional_client}
regional_client = audit_info.audit_session.client(
service, region_name=AWS_REGION_EU_WEST_1
)
regional_client.region = AWS_REGION_EU_WEST_1
return {AWS_REGION_EU_WEST_1: regional_client}
# Patch every AWS call using Boto3 and generate_regional_clients to have 1 client
@@ -109,7 +104,7 @@ class Test_CodeArtifact_Service:
def test__get_client__(self):
codeartifact = CodeArtifact(set_mocked_aws_audit_info([AWS_REGION_EU_WEST_1]))
assert (
codeartifact.regional_clients[AWS_REGION].__class__.__name__
codeartifact.regional_clients[AWS_REGION_EU_WEST_1].__class__.__name__
== "CodeArtifact"
)
@@ -130,11 +125,11 @@ class Test_CodeArtifact_Service:
assert len(codeartifact.repositories) == 1
assert codeartifact.repositories
assert codeartifact.repositories[
f"arn:aws:codebuild:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:repository/test-repository"
f"arn:aws:codebuild:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:repository/test-repository"
]
assert codeartifact.repositories[TEST_REPOSITORY_ARN].name == "test-repository"
assert codeartifact.repositories[
f"arn:aws:codebuild:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:repository/test-repository"
f"arn:aws:codebuild:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:repository/test-repository"
].tags == [
{"key": "test", "value": "test"},
]
@@ -146,10 +141,13 @@ class Test_CodeArtifact_Service:
codeartifact.repositories[TEST_REPOSITORY_ARN].domain_owner
== DEFAULT_ACCOUNT_ID
)
assert codeartifact.repositories[TEST_REPOSITORY_ARN].region == AWS_REGION
assert (
codeartifact.repositories[TEST_REPOSITORY_ARN].region
== AWS_REGION_EU_WEST_1
)
assert codeartifact.repositories[
f"arn:aws:codebuild:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:repository/test-repository"
f"arn:aws:codebuild:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:repository/test-repository"
].packages
assert len(codeartifact.repositories[TEST_REPOSITORY_ARN].packages) == 1
assert (
@@ -3,16 +3,17 @@ from re import search
from unittest import mock
from prowler.providers.aws.services.codebuild.codebuild_service import Project
AWS_REGION = "eu-west-1"
AWS_ACCOUNT_NUMBER = "123456789012"
from tests.providers.aws.audit_info_utils import (
AWS_ACCOUNT_NUMBER,
AWS_REGION_EU_WEST_1,
)
class Test_codebuild_project_older_90_days:
def test_project_not_built_in_last_90_days(self):
codebuild_client = mock.MagicMock
project_name = "test-project"
project_arn = f"arn:aws:codebuild:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:project/{project_name}"
project_arn = f"arn:aws:codebuild:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:project/{project_name}"
codebuild_client.projects = [
Project(
name=project_name,
@@ -41,12 +42,12 @@ class Test_codebuild_project_older_90_days:
assert result[0].resource_id == project_name
assert result[0].resource_arn == project_arn
assert result[0].resource_tags == []
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
def test_project_not_built(self):
codebuild_client = mock.MagicMock
project_name = "test-project"
project_arn = f"arn:aws:codebuild:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:project/{project_name}"
project_arn = f"arn:aws:codebuild:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:project/{project_name}"
codebuild_client.projects = [
Project(
name=project_name,
@@ -73,12 +74,12 @@ class Test_codebuild_project_older_90_days:
assert result[0].resource_id == project_name
assert result[0].resource_arn == project_arn
assert result[0].resource_tags == []
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
def test_project_built_in_last_90_days(self):
codebuild_client = mock.MagicMock
project_name = "test-project"
project_arn = f"arn:aws:codebuild:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:project/{project_name}"
project_arn = f"arn:aws:codebuild:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:project/{project_name}"
codebuild_client.projects = [
Project(
name=project_name,
@@ -107,4 +108,4 @@ class Test_codebuild_project_older_90_days:
assert result[0].resource_id == project_name
assert result[0].resource_arn == project_arn
assert result[0].resource_tags == []
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
@@ -2,16 +2,17 @@ from re import search
from unittest import mock
from prowler.providers.aws.services.codebuild.codebuild_service import Project
AWS_REGION = "eu-west-1"
AWS_ACCOUNT_NUMBER = "123456789012"
from tests.providers.aws.audit_info_utils import (
AWS_ACCOUNT_NUMBER,
AWS_REGION_EU_WEST_1,
)
class Test_codebuild_project_user_controlled_buildspec:
def test_project_not_buildspec(self):
codebuild_client = mock.MagicMock
project_name = "test-project"
project_arn = f"arn:aws:codebuild:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:project/{project_name}"
project_arn = f"arn:aws:codebuild:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:project/{project_name}"
codebuild_client.projects = [
Project(
name=project_name,
@@ -41,12 +42,12 @@ class Test_codebuild_project_user_controlled_buildspec:
assert result[0].resource_id == project_name
assert result[0].resource_arn == project_arn
assert result[0].resource_tags == []
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
def test_project_buildspec_not_yaml(self):
codebuild_client = mock.MagicMock
project_name = "test-project"
project_arn = f"arn:aws:codebuild:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:project/{project_name}"
project_arn = f"arn:aws:codebuild:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:project/{project_name}"
codebuild_client.projects = [
Project(
name=project_name,
@@ -76,12 +77,12 @@ class Test_codebuild_project_user_controlled_buildspec:
assert result[0].resource_id == project_name
assert result[0].resource_arn == project_arn
assert result[0].resource_tags == []
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
def test_project_valid_buildspec(self):
codebuild_client = mock.MagicMock
project_name = "test-project"
project_arn = f"arn:aws:codebuild:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:project/{project_name}"
project_arn = f"arn:aws:codebuild:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:project/{project_name}"
codebuild_client.projects = [
Project(
name=project_name,
@@ -110,12 +111,12 @@ class Test_codebuild_project_user_controlled_buildspec:
assert result[0].resource_id == project_name
assert result[0].resource_arn == project_arn
assert result[0].resource_tags == []
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
def test_project_invalid_buildspec_without_extension(self):
codebuild_client = mock.MagicMock
project_name = "test-project"
project_arn = f"arn:aws:codebuild:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:project/{project_name}"
project_arn = f"arn:aws:codebuild:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:project/{project_name}"
codebuild_client.projects = [
Project(
name=project_name,
@@ -145,4 +146,4 @@ class Test_codebuild_project_user_controlled_buildspec:
assert result[0].resource_id == project_name
assert result[0].resource_arn == project_arn
assert result[0].resource_tags == []
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
@@ -2,20 +2,13 @@ from datetime import datetime, timedelta
from unittest.mock import patch
import botocore
from boto3 import session
from prowler.providers.aws.lib.audit_info.models import AWS_Audit_Info
from prowler.providers.aws.services.codebuild.codebuild_service import Codebuild
from prowler.providers.common.models import Audit_Metadata
from tests.providers.aws.audit_info_utils import (
AWS_REGION_EU_WEST_1,
set_mocked_aws_audit_info,
)
# Mock Test Region
AWS_REGION = "eu-west-1"
AWS_ACCOUNT_NUMBER = "123456789012"
# last time invoked time
last_invoked_time = datetime.now() - timedelta(days=2)
@@ -46,9 +39,11 @@ def mock_make_api_call(self, operation_name, kwarg):
# Mock generate_regional_clients()
def mock_generate_regional_clients(service, audit_info, _):
regional_client = audit_info.audit_session.client(service, region_name=AWS_REGION)
regional_client.region = AWS_REGION
return {AWS_REGION: regional_client}
regional_client = audit_info.audit_session.client(
service, region_name=AWS_REGION_EU_WEST_1
)
regional_client.region = AWS_REGION_EU_WEST_1
return {AWS_REGION_EU_WEST_1: regional_client}
@patch("botocore.client.BaseClient._make_api_call", new=mock_make_api_call)
@@ -57,36 +52,6 @@ def mock_generate_regional_clients(service, audit_info, _):
new=mock_generate_regional_clients,
)
class Test_Codebuild_Service:
def set_mocked_audit_info(self):
audit_info = AWS_Audit_Info(
session_config=None,
original_session=None,
audit_session=session.Session(
profile_name=None,
botocore_session=None,
),
audited_account=AWS_ACCOUNT_NUMBER,
audited_account_arn=f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root",
audited_user_id=None,
audited_partition="aws",
audited_identity_arn=None,
profile=None,
profile_region=None,
credentials=None,
assumed_role_info=None,
audited_regions=None,
organizations_metadata=None,
audit_resources=None,
mfa_enabled=False,
audit_metadata=Audit_Metadata(
services_scanned=0,
expected_checks=[],
completed_checks=0,
audit_progress=0,
),
)
return audit_info
# Test Codebuild Session
def test__get_session__(self):
codebuild = Codebuild(set_mocked_aws_audit_info([AWS_REGION_EU_WEST_1]))
@@ -101,13 +66,13 @@ class Test_Codebuild_Service:
codebuild = Codebuild(set_mocked_aws_audit_info([AWS_REGION_EU_WEST_1]))
assert len(codebuild.projects) == 1
assert codebuild.projects[0].name == "test"
assert codebuild.projects[0].region == AWS_REGION
assert codebuild.projects[0].region == AWS_REGION_EU_WEST_1
def test__list_builds_for_project__(self):
codebuild = Codebuild(set_mocked_aws_audit_info([AWS_REGION_EU_WEST_1]))
assert len(codebuild.projects) == 1
assert codebuild.projects[0].name == "test"
assert codebuild.projects[0].region == AWS_REGION
assert codebuild.projects[0].region == AWS_REGION_EU_WEST_1
assert codebuild.projects[0].last_invoked_time == last_invoked_time
assert (
codebuild.projects[0].buildspec
@@ -4,12 +4,11 @@ from boto3 import client
from moto import mock_config
from tests.providers.aws.audit_info_utils import (
AWS_ACCOUNT_NUMBER,
AWS_REGION_EU_WEST_1,
set_mocked_aws_audit_info,
)
AWS_REGION = "us-east-1"
AWS_ACCOUNT_NUMBER = "123456789012"
AWS_ACCOUNT_ARN = f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root"
@@ -49,7 +48,7 @@ class Test_config_recorder_all_regions_enabled:
@mock_config
def test_config_one_recoder_disabled(self):
# Create Config Mocked Resources
config_client = client("config", region_name=AWS_REGION)
config_client = client("config", region_name=AWS_REGION_EU_WEST_1)
# Create Config Recorder
config_client.put_configuration_recorder(
ConfigurationRecorder={"name": "default", "roleARN": "somearn"}
@@ -57,7 +56,7 @@ class Test_config_recorder_all_regions_enabled:
from prowler.providers.aws.services.config.config_service import Config
current_audit_info = set_mocked_aws_audit_info([AWS_REGION_EU_WEST_1])
current_audit_info.audited_regions = [AWS_REGION]
current_audit_info.audited_regions = [AWS_REGION_EU_WEST_1]
with mock.patch(
"prowler.providers.aws.lib.audit_info.audit_info.current_audit_info",
@@ -84,12 +83,12 @@ class Test_config_recorder_all_regions_enabled:
)
assert recorder.resource_id == "default"
assert recorder.resource_arn == AWS_ACCOUNT_ARN
assert recorder.region == AWS_REGION
assert recorder.region == AWS_REGION_EU_WEST_1
@mock_config
def test_config_one_recoder_enabled(self):
# Create Config Mocked Resources
config_client = client("config", region_name=AWS_REGION)
config_client = client("config", region_name=AWS_REGION_EU_WEST_1)
# Create Config Recorder and start it
config_client.put_configuration_recorder(
ConfigurationRecorder={"name": "default", "roleARN": "somearn"}
@@ -102,7 +101,7 @@ class Test_config_recorder_all_regions_enabled:
from prowler.providers.aws.services.config.config_service import Config
current_audit_info = set_mocked_aws_audit_info([AWS_REGION_EU_WEST_1])
current_audit_info.audited_regions = [AWS_REGION]
current_audit_info.audited_regions = [AWS_REGION_EU_WEST_1]
with mock.patch(
"prowler.providers.aws.lib.audit_info.audit_info.current_audit_info",
@@ -129,12 +128,12 @@ class Test_config_recorder_all_regions_enabled:
)
assert recorder.resource_id == "default"
assert recorder.resource_arn == AWS_ACCOUNT_ARN
assert recorder.region == AWS_REGION
assert recorder.region == AWS_REGION_EU_WEST_1
@mock_config
def test_config_one_recorder_disabled_allowlisted(self):
# Create Config Mocked Resources
config_client = client("config", region_name=AWS_REGION)
config_client = client("config", region_name=AWS_REGION_EU_WEST_1)
# Create Config Recorder
config_client.put_configuration_recorder(
ConfigurationRecorder={"name": AWS_ACCOUNT_NUMBER, "roleARN": "somearn"}
@@ -143,7 +142,7 @@ class Test_config_recorder_all_regions_enabled:
current_audit_info = set_mocked_aws_audit_info([AWS_REGION_EU_WEST_1])
current_audit_info.profile_region = "eu-south-2"
current_audit_info.audited_regions = ["eu-south-2", AWS_REGION]
current_audit_info.audited_regions = ["eu-south-2", AWS_REGION_EU_WEST_1]
current_audit_info.audit_config = {"allowlist_non_default_regions": True}
with mock.patch(
@@ -163,7 +162,7 @@ class Test_config_recorder_all_regions_enabled:
assert len(result) == 2
# Search for the recorder just created
for recorder in result:
if recorder.region == AWS_REGION:
if recorder.region == AWS_REGION_EU_WEST_1:
assert recorder.status == "WARNING"
assert (
recorder.status_extended
@@ -171,7 +170,7 @@ class Test_config_recorder_all_regions_enabled:
)
assert recorder.resource_id == AWS_ACCOUNT_NUMBER
assert recorder.resource_arn == AWS_ACCOUNT_ARN
assert recorder.region == AWS_REGION
assert recorder.region == AWS_REGION_EU_WEST_1
else:
assert recorder.status == "FAIL"
assert (
@@ -1,49 +1,15 @@
from boto3 import client, session
from boto3 import client
from moto import mock_config
from prowler.providers.aws.lib.audit_info.models import AWS_Audit_Info
from prowler.providers.aws.services.config.config_service import Config
from prowler.providers.common.models import Audit_Metadata
from tests.providers.aws.audit_info_utils import (
AWS_ACCOUNT_NUMBER,
AWS_REGION_EU_WEST_1,
set_mocked_aws_audit_info,
)
AWS_ACCOUNT_NUMBER = "123456789012"
AWS_REGION = "us-east-1"
class Test_Config_Service:
def set_mocked_audit_info(self):
audit_info = AWS_Audit_Info(
session_config=None,
original_session=None,
audit_session=session.Session(
profile_name=None,
botocore_session=None,
),
audited_account=AWS_ACCOUNT_NUMBER,
audited_account_arn=f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root",
audited_user_id=None,
audited_partition="aws",
audited_identity_arn=None,
profile=None,
profile_region=None,
credentials=None,
assumed_role_info=None,
audited_regions=["eu-west-1", "us-east-1"],
organizations_metadata=None,
audit_resources=None,
mfa_enabled=False,
audit_metadata=Audit_Metadata(
services_scanned=0,
expected_checks=[],
completed_checks=0,
audit_progress=0,
),
)
return audit_info
# Test Config Service
@mock_config
def test_service(self):
@@ -81,7 +47,7 @@ class Test_Config_Service:
@mock_config
def test__describe_configuration_recorder_status__(self):
# Generate Config Client
config_client = client("config", region_name=AWS_REGION)
config_client = client("config", region_name=AWS_REGION_EU_WEST_1)
# Create Config Recorder and start it
config_client.put_configuration_recorder(
ConfigurationRecorder={"name": "default", "roleARN": "somearn"}
@@ -6,9 +6,10 @@ from prowler.providers.aws.services.directoryservice.directoryservice_service im
DirectoryType,
LogSubscriptions,
)
AWS_REGION = "eu-west-1"
AWS_ACCOUNT_NUMBER = "123456789012"
from tests.providers.aws.audit_info_utils import (
AWS_ACCOUNT_NUMBER,
AWS_REGION_EU_WEST_1,
)
class Test_directoryservice_directory_log_forwarding_enabled:
@@ -33,16 +34,14 @@ class Test_directoryservice_directory_log_forwarding_enabled:
directoryservice_client = mock.MagicMock
directory_name = "test-directory"
directory_id = "d-12345a1b2"
directory_arn = (
f"arn:aws:ds:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:directory/d-12345a1b2"
)
directory_arn = f"arn:aws:ds:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:directory/d-12345a1b2"
directoryservice_client.directories = {
directory_name: Directory(
name=directory_name,
arn=directory_arn,
id=directory_id,
type=DirectoryType.MicrosoftAD,
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
log_subscriptions=[],
)
}
@@ -62,7 +61,7 @@ class Test_directoryservice_directory_log_forwarding_enabled:
assert result[0].resource_id == directory_id
assert result[0].resource_arn == directory_arn
assert result[0].resource_tags == []
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].status == "FAIL"
assert (
result[0].status_extended
@@ -73,16 +72,14 @@ class Test_directoryservice_directory_log_forwarding_enabled:
directoryservice_client = mock.MagicMock
directory_name = "test-directory"
directory_id = "d-12345a1b2"
directory_arn = (
f"arn:aws:ds:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:directory/d-12345a1b2"
)
directory_arn = f"arn:aws:ds:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:directory/d-12345a1b2"
directoryservice_client.directories = {
directory_name: Directory(
name=directory_name,
arn=directory_arn,
id=directory_id,
type=DirectoryType.MicrosoftAD,
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
log_subscriptions=[
LogSubscriptions(
log_group_name="test-log-group",
@@ -108,7 +105,7 @@ class Test_directoryservice_directory_log_forwarding_enabled:
assert result[0].resource_id == directory_id
assert result[0].resource_arn == directory_arn
assert result[0].resource_tags == []
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].status == "PASS"
assert (
result[0].status_extended
@@ -9,9 +9,10 @@ from prowler.providers.aws.services.directoryservice.directoryservice_service im
EventTopics,
EventTopicStatus,
)
AWS_REGION = "eu-west-1"
AWS_ACCOUNT_NUMBER = "123456789012"
from tests.providers.aws.audit_info_utils import (
AWS_ACCOUNT_NUMBER,
AWS_REGION_EU_WEST_1,
)
class Test_directoryservice_directory_monitor_notifications:
@@ -36,16 +37,14 @@ class Test_directoryservice_directory_monitor_notifications:
directoryservice_client = mock.MagicMock
directory_name = "test-directory"
directory_id = "d-12345a1b2"
directory_arn = (
f"arn:aws:ds:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:directory/d-12345a1b2"
)
directory_arn = f"arn:aws:ds:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:directory/d-12345a1b2"
directoryservice_client.directories = {
directory_name: Directory(
id=directory_id,
arn=directory_arn,
type=DirectoryType.MicrosoftAD,
name=directory_name,
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
event_topics=[],
)
}
@@ -65,7 +64,7 @@ class Test_directoryservice_directory_monitor_notifications:
assert result[0].resource_id == directory_id
assert result[0].resource_arn == directory_arn
assert result[0].resource_tags == []
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].status == "FAIL"
assert (
result[0].status_extended
@@ -76,19 +75,17 @@ class Test_directoryservice_directory_monitor_notifications:
directoryservice_client = mock.MagicMock
directory_name = "test-directory"
directory_id = "d-12345a1b2"
directory_arn = (
f"arn:aws:ds:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:directory/d-12345a1b2"
)
directory_arn = f"arn:aws:ds:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:directory/d-12345a1b2"
directoryservice_client.directories = {
directory_name: Directory(
name=directory_name,
id=directory_id,
arn=directory_arn,
type=DirectoryType.MicrosoftAD,
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
event_topics=[
EventTopics(
topic_arn=f"arn:aws:sns:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:test-topic",
topic_arn=f"arn:aws:sns:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:test-topic",
topic_name="test-topic",
status=EventTopicStatus.Registered,
created_date_time=datetime(2022, 1, 1),
@@ -112,7 +109,7 @@ class Test_directoryservice_directory_monitor_notifications:
assert result[0].resource_id == directory_id
assert result[0].resource_arn == directory_arn
assert result[0].resource_tags == []
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].status == "PASS"
assert (
result[0].status_extended
@@ -5,9 +5,10 @@ from prowler.providers.aws.services.directoryservice.directoryservice_service im
DirectoryType,
SnapshotLimit,
)
AWS_REGION = "eu-west-1"
AWS_ACCOUNT_NUMBER = "123456789012"
from tests.providers.aws.audit_info_utils import (
AWS_ACCOUNT_NUMBER,
AWS_REGION_EU_WEST_1,
)
class Test_directoryservice_directory_snapshots_limit:
@@ -32,9 +33,7 @@ class Test_directoryservice_directory_snapshots_limit:
directoryservice_client = mock.MagicMock
directory_name = "test-directory"
directory_id = "d-12345a1b2"
directory_arn = (
f"arn:aws:ds:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:directory/d-12345a1b2"
)
directory_arn = f"arn:aws:ds:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:directory/d-12345a1b2"
manual_snapshots_current_count = 5
manual_snapshots_limit = 5
manual_snapshots_limit_reached = True
@@ -44,7 +43,7 @@ class Test_directoryservice_directory_snapshots_limit:
id=directory_id,
arn=directory_arn,
type=DirectoryType.MicrosoftAD,
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
snapshots_limits=SnapshotLimit(
manual_snapshots_current_count=manual_snapshots_current_count,
manual_snapshots_limit=manual_snapshots_limit,
@@ -68,7 +67,7 @@ class Test_directoryservice_directory_snapshots_limit:
assert result[0].resource_id == directory_id
assert result[0].resource_arn == directory_arn
assert result[0].resource_tags == []
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].status == "FAIL"
assert (
result[0].status_extended
@@ -79,9 +78,7 @@ class Test_directoryservice_directory_snapshots_limit:
directoryservice_client = mock.MagicMock
directory_name = "test-directory"
directory_id = "d-12345a1b2"
directory_arn = (
f"arn:aws:ds:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:directory/d-12345a1b2"
)
directory_arn = f"arn:aws:ds:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:directory/d-12345a1b2"
manual_snapshots_current_count = 4
manual_snapshots_limit = 5
manual_snapshots_limit_reached = False
@@ -91,7 +88,7 @@ class Test_directoryservice_directory_snapshots_limit:
id=directory_id,
arn=directory_arn,
type=DirectoryType.MicrosoftAD,
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
snapshots_limits=SnapshotLimit(
manual_snapshots_current_count=manual_snapshots_current_count,
manual_snapshots_limit=manual_snapshots_limit,
@@ -115,7 +112,7 @@ class Test_directoryservice_directory_snapshots_limit:
assert result[0].resource_id == directory_id
assert result[0].resource_arn == directory_arn
assert result[0].resource_tags == []
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].status == "FAIL"
assert (
result[0].status_extended
@@ -126,9 +123,7 @@ class Test_directoryservice_directory_snapshots_limit:
directoryservice_client = mock.MagicMock
directory_name = "test-directory"
directory_id = "d-12345a1b2"
directory_arn = (
f"arn:aws:ds:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:directory/d-12345a1b2"
)
directory_arn = f"arn:aws:ds:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:directory/d-12345a1b2"
manual_snapshots_current_count = 3
manual_snapshots_limit = 5
manual_snapshots_limit_reached = False
@@ -138,7 +133,7 @@ class Test_directoryservice_directory_snapshots_limit:
id=directory_id,
arn=directory_arn,
type=DirectoryType.MicrosoftAD,
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
snapshots_limits=SnapshotLimit(
manual_snapshots_current_count=manual_snapshots_current_count,
manual_snapshots_limit=manual_snapshots_limit,
@@ -162,7 +157,7 @@ class Test_directoryservice_directory_snapshots_limit:
assert result[0].resource_id == directory_id
assert result[0].resource_arn == directory_arn
assert result[0].resource_tags == []
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].status == "FAIL"
assert (
result[0].status_extended
@@ -173,9 +168,7 @@ class Test_directoryservice_directory_snapshots_limit:
directoryservice_client = mock.MagicMock
directory_name = "test-directory"
directory_id = "d-12345a1b2"
directory_arn = (
f"arn:aws:ds:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:directory/d-12345a1b2"
)
directory_arn = f"arn:aws:ds:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:directory/d-12345a1b2"
manual_snapshots_current_count = 1
manual_snapshots_limit = 5
manual_snapshots_limit_reached = False
@@ -185,7 +178,7 @@ class Test_directoryservice_directory_snapshots_limit:
id=directory_id,
arn=directory_arn,
type=DirectoryType.MicrosoftAD,
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
snapshots_limits=SnapshotLimit(
manual_snapshots_current_count=manual_snapshots_current_count,
manual_snapshots_limit=manual_snapshots_limit,
@@ -209,7 +202,7 @@ class Test_directoryservice_directory_snapshots_limit:
assert result[0].resource_id == directory_id
assert result[0].resource_arn == directory_arn
assert result[0].resource_tags == []
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].status == "PASS"
assert (
result[0].status_extended
@@ -10,9 +10,10 @@ from prowler.providers.aws.services.directoryservice.directoryservice_service im
Directory,
DirectoryType,
)
AWS_REGION = "eu-west-1"
AWS_ACCOUNT_NUMBER = "123456789012"
from tests.providers.aws.audit_info_utils import (
AWS_ACCOUNT_NUMBER,
AWS_REGION_EU_WEST_1,
)
# Always use a mocked date to test the certificates expiration
@@ -39,16 +40,14 @@ class Test_directoryservice_ldap_certificate_expiration:
directoryservice_client = mock.MagicMock
directory_name = "test-directory"
directory_id = "d-12345a1b2"
directory_arn = (
f"arn:aws:ds:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:directory/d-12345a1b2"
)
directory_arn = f"arn:aws:ds:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:directory/d-12345a1b2"
directoryservice_client.directories = {
directory_name: Directory(
id=directory_id,
arn=directory_arn,
type=DirectoryType.MicrosoftAD,
name=directory_name,
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
certificates=[],
)
}
@@ -73,16 +72,14 @@ class Test_directoryservice_ldap_certificate_expiration:
directory_name = "test-directory"
certificate_id = "test-certificate"
directory_id = "d-12345a1b2"
directory_arn = (
f"arn:aws:ds:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:directory/d-12345a1b2"
)
directory_arn = f"arn:aws:ds:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:directory/d-12345a1b2"
directoryservice_client.directories = {
directory_name: Directory(
name=directory_name,
id=directory_id,
arn=directory_arn,
type=DirectoryType.MicrosoftAD,
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
certificates=[
Certificate(
id=certificate_id,
@@ -111,7 +108,7 @@ class Test_directoryservice_ldap_certificate_expiration:
assert result[0].resource_id == certificate_id
assert result[0].resource_arn == directory_arn
assert result[0].resource_tags == []
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].status == "PASS"
assert (
result[0].status_extended
@@ -125,16 +122,14 @@ class Test_directoryservice_ldap_certificate_expiration:
directory_name = "test-directory"
certificate_id = "test-certificate"
directory_id = "d-12345a1b2"
directory_arn = (
f"arn:aws:ds:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:directory/d-12345a1b2"
)
directory_arn = f"arn:aws:ds:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:directory/d-12345a1b2"
directoryservice_client.directories = {
directory_name: Directory(
name=directory_name,
id=directory_id,
arn=directory_arn,
type=DirectoryType.MicrosoftAD,
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
certificates=[
Certificate(
id=certificate_id,
@@ -163,7 +158,7 @@ class Test_directoryservice_ldap_certificate_expiration:
assert result[0].resource_id == certificate_id
assert result[0].resource_arn == directory_arn
assert result[0].resource_tags == []
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].status == "FAIL"
assert (
result[0].status_extended
@@ -177,16 +172,14 @@ class Test_directoryservice_ldap_certificate_expiration:
directory_name = "test-directory"
certificate_id = "test-certificate"
directory_id = "d-12345a1b2"
directory_arn = (
f"arn:aws:ds:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:directory/d-12345a1b2"
)
directory_arn = f"arn:aws:ds:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:directory/d-12345a1b2"
directoryservice_client.directories = {
directory_name: Directory(
name=directory_name,
id=directory_id,
arn=directory_arn,
type=DirectoryType.MicrosoftAD,
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
certificates=[
Certificate(
id=certificate_id,
@@ -215,7 +208,7 @@ class Test_directoryservice_ldap_certificate_expiration:
assert result[0].resource_id == certificate_id
assert result[0].resource_arn == directory_arn
assert result[0].resource_tags == []
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].status == "FAIL"
assert (
result[0].status_extended
@@ -7,9 +7,10 @@ from prowler.providers.aws.services.directoryservice.directoryservice_service im
RadiusSettings,
RadiusStatus,
)
AWS_REGION = "eu-west-1"
AWS_ACCOUNT_NUMBER = "123456789012"
from tests.providers.aws.audit_info_utils import (
AWS_ACCOUNT_NUMBER,
AWS_REGION_EU_WEST_1,
)
class Test_directoryservice_radius_server_security_protocol:
@@ -34,16 +35,14 @@ class Test_directoryservice_radius_server_security_protocol:
directoryservice_client = mock.MagicMock
directory_name = "test-directory"
directory_id = "d-12345a1b2"
directory_arn = (
f"arn:aws:ds:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:directory/d-12345a1b2"
)
directory_arn = f"arn:aws:ds:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:directory/d-12345a1b2"
directoryservice_client.directories = {
directory_name: Directory(
name=directory_name,
id=directory_id,
arn=directory_arn,
type=DirectoryType.MicrosoftAD,
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
radius_settings=None,
)
}
@@ -65,16 +64,14 @@ class Test_directoryservice_radius_server_security_protocol:
directoryservice_client = mock.MagicMock
directory_name = "test-directory"
directory_id = "d-12345a1b2"
directory_arn = (
f"arn:aws:ds:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:directory/d-12345a1b2"
)
directory_arn = f"arn:aws:ds:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:directory/d-12345a1b2"
directoryservice_client.directories = {
directory_name: Directory(
name=directory_name,
id=directory_id,
arn=directory_arn,
type=DirectoryType.MicrosoftAD,
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
radius_settings=RadiusSettings(
authentication_protocol=AuthenticationProtocol.MS_CHAPv1,
status=RadiusStatus.Completed,
@@ -97,7 +94,7 @@ class Test_directoryservice_radius_server_security_protocol:
assert result[0].resource_id == directory_id
assert result[0].resource_arn == directory_arn
assert result[0].resource_tags == []
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].status == "FAIL"
assert (
result[0].status_extended
@@ -108,16 +105,14 @@ class Test_directoryservice_radius_server_security_protocol:
directoryservice_client = mock.MagicMock
directory_name = "test-directory"
directory_id = "d-12345a1b2"
directory_arn = (
f"arn:aws:ds:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:directory/d-12345a1b2"
)
directory_arn = f"arn:aws:ds:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:directory/d-12345a1b2"
directoryservice_client.directories = {
directory_name: Directory(
name=directory_name,
id=directory_id,
arn=directory_arn,
type=DirectoryType.MicrosoftAD,
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
radius_settings=RadiusSettings(
authentication_protocol=AuthenticationProtocol.MS_CHAPv2,
status=RadiusStatus.Completed,
@@ -140,7 +135,7 @@ class Test_directoryservice_radius_server_security_protocol:
assert result[0].resource_id == directory_id
assert result[0].resource_arn == directory_arn
assert result[0].resource_tags == []
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].status == "PASS"
assert (
result[0].status_extended
@@ -15,15 +15,11 @@ from prowler.providers.aws.services.directoryservice.directoryservice_service im
RadiusStatus,
)
from tests.providers.aws.audit_info_utils import (
AWS_ACCOUNT_NUMBER,
AWS_REGION_EU_WEST_1,
set_mocked_aws_audit_info,
)
# Mock Test Region
AWS_REGION = "eu-west-1"
AWS_ACCOUNT_NUMBER = "123456789012"
# Mocking Access Analyzer Calls
make_api_call = botocore.client.BaseClient._make_api_call
@@ -70,7 +66,7 @@ def mock_make_api_call(self, operation_name, kwarg):
{
"DirectoryId": "d-12345a1b2",
"TopicName": "test-topic",
"TopicArn": f"arn:aws:sns:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:test-topic",
"TopicArn": f"arn:aws:sns:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:test-topic",
"CreatedDateTime": datetime(2022, 1, 1),
"Status": "Registered",
},
@@ -108,9 +104,11 @@ def mock_make_api_call(self, operation_name, kwarg):
# Mock generate_regional_clients()
def mock_generate_regional_clients(service, audit_info, _):
regional_client = audit_info.audit_session.client(service, region_name=AWS_REGION)
regional_client.region = AWS_REGION
return {AWS_REGION: regional_client}
regional_client = audit_info.audit_session.client(
service, region_name=AWS_REGION_EU_WEST_1
)
regional_client.region = AWS_REGION_EU_WEST_1
return {AWS_REGION_EU_WEST_1: regional_client}
# Patch every AWS call using Boto3 and generate_regional_clients to have 1 client
@@ -127,7 +125,7 @@ class Test_DirectoryService_Service:
set_mocked_aws_audit_info([AWS_REGION_EU_WEST_1])
)
assert (
directoryservice.regional_clients[AWS_REGION].__class__.__name__
directoryservice.regional_clients[AWS_REGION_EU_WEST_1].__class__.__name__
== "DirectoryService"
)
@@ -158,14 +156,16 @@ class Test_DirectoryService_Service:
assert directoryservice.directories["d-12345a1b2"].id == "d-12345a1b2"
assert (
directoryservice.directories["d-12345a1b2"].arn
== f"arn:aws:ds:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:directory/d-12345a1b2"
== f"arn:aws:ds:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:directory/d-12345a1b2"
)
assert (
directoryservice.directories["d-12345a1b2"].type
== DirectoryType.MicrosoftAD
)
assert directoryservice.directories["d-12345a1b2"].name == "test-directory"
assert directoryservice.directories["d-12345a1b2"].region == AWS_REGION
assert (
directoryservice.directories["d-12345a1b2"].region == AWS_REGION_EU_WEST_1
)
assert directoryservice.directories["d-12345a1b2"].tags == [
{"Key": "string", "Value": "string"},
]
@@ -200,7 +200,7 @@ class Test_DirectoryService_Service:
)
assert (
directoryservice.directories["d-12345a1b2"].event_topics[0].topic_arn
== f"arn:aws:sns:{AWS_REGION}:{DEFAULT_ACCOUNT_ID}:test-topic"
== f"arn:aws:sns:{AWS_REGION_EU_WEST_1}:{DEFAULT_ACCOUNT_ID}:test-topic"
)
assert (
directoryservice.directories["d-12345a1b2"].event_topics[0].status
@@ -7,9 +7,10 @@ from prowler.providers.aws.services.directoryservice.directoryservice_service im
RadiusSettings,
RadiusStatus,
)
AWS_REGION = "eu-west-1"
AWS_ACCOUNT_NUMBER = "123456789012"
from tests.providers.aws.audit_info_utils import (
AWS_ACCOUNT_NUMBER,
AWS_REGION_EU_WEST_1,
)
class Test_directoryservice_supported_mfa_radius_enabled:
@@ -34,16 +35,14 @@ class Test_directoryservice_supported_mfa_radius_enabled:
directoryservice_client = mock.MagicMock
directory_name = "test-directory"
directory_id = "d-12345a1b2"
directory_arn = (
f"arn:aws:ds:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:directory/d-12345a1b2"
)
directory_arn = f"arn:aws:ds:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:directory/d-12345a1b2"
directoryservice_client.directories = {
directory_name: Directory(
name=directory_name,
id=directory_id,
arn=directory_arn,
type=DirectoryType.MicrosoftAD,
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
radius_settings=None,
)
}
@@ -65,16 +64,14 @@ class Test_directoryservice_supported_mfa_radius_enabled:
directoryservice_client = mock.MagicMock
directory_name = "test-directory"
directory_id = "d-12345a1b2"
directory_arn = (
f"arn:aws:ds:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:directory/d-12345a1b2"
)
directory_arn = f"arn:aws:ds:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:directory/d-12345a1b2"
directoryservice_client.directories = {
directory_name: Directory(
name=directory_name,
id=directory_id,
arn=directory_arn,
type=DirectoryType.MicrosoftAD,
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
radius_settings=RadiusSettings(
authentication_protocol=AuthenticationProtocol.MS_CHAPv1,
status=RadiusStatus.Failed,
@@ -97,7 +94,7 @@ class Test_directoryservice_supported_mfa_radius_enabled:
assert result[0].resource_id == directory_id
assert result[0].resource_arn == directory_arn
assert result[0].resource_tags == []
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].status == "FAIL"
assert (
result[0].status_extended
@@ -108,16 +105,14 @@ class Test_directoryservice_supported_mfa_radius_enabled:
directoryservice_client = mock.MagicMock
directory_name = "test-directory"
directory_id = "d-12345a1b2"
directory_arn = (
f"arn:aws:ds:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:directory/d-12345a1b2"
)
directory_arn = f"arn:aws:ds:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:directory/d-12345a1b2"
directoryservice_client.directories = {
directory_name: Directory(
name=directory_name,
id=directory_id,
arn=directory_arn,
type=DirectoryType.MicrosoftAD,
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
radius_settings=RadiusSettings(
authentication_protocol=AuthenticationProtocol.MS_CHAPv2,
status=RadiusStatus.Creating,
@@ -140,7 +135,7 @@ class Test_directoryservice_supported_mfa_radius_enabled:
assert result[0].resource_id == directory_id
assert result[0].resource_arn == directory_arn
assert result[0].resource_tags == []
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].status == "FAIL"
assert (
result[0].status_extended
@@ -151,16 +146,14 @@ class Test_directoryservice_supported_mfa_radius_enabled:
directoryservice_client = mock.MagicMock
directory_name = "test-directory"
directory_id = "d-12345a1b2"
directory_arn = (
f"arn:aws:ds:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:directory/d-12345a1b2"
)
directory_arn = f"arn:aws:ds:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:directory/d-12345a1b2"
directoryservice_client.directories = {
directory_name: Directory(
name=directory_name,
id=directory_id,
arn=directory_arn,
type=DirectoryType.MicrosoftAD,
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
radius_settings=RadiusSettings(
authentication_protocol=AuthenticationProtocol.MS_CHAPv2,
status=RadiusStatus.Completed,
@@ -183,7 +176,7 @@ class Test_directoryservice_supported_mfa_radius_enabled:
assert result[0].resource_id == directory_id
assert result[0].resource_arn == directory_arn
assert result[0].resource_tags == []
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].status == "PASS"
assert (
result[0].status_extended
@@ -1,54 +1,22 @@
from unittest import mock
from boto3 import client, resource, session
from boto3 import client, resource
from moto import mock_ec2
from prowler.providers.aws.lib.audit_info.models import AWS_Audit_Info
from prowler.providers.aws.services.dlm.dlm_service import LifecyclePolicy
from prowler.providers.common.models import Audit_Metadata
from tests.providers.aws.audit_info_utils import (
AWS_ACCOUNT_NUMBER,
AWS_REGION_EU_WEST_1,
set_mocked_aws_audit_info,
)
AWS_ACCOUNT_NUMBER = "123456789012"
AWS_ACCOUNT_ARN = f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root"
AWS_REGION = "us-east-1"
LIFECYCLE_POLICY_ID = "policy-XXXXXXXXXXXX"
class Test_dlm_ebs_snapshot_lifecycle_policy_exists:
def set_mocked_audit_info(self):
return AWS_Audit_Info(
session_config=None,
original_session=None,
audit_session=session.Session(
profile_name=None,
botocore_session=None,
),
audit_config=None,
audited_account=AWS_ACCOUNT_NUMBER,
audited_account_arn=f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root",
audited_user_id=None,
audited_partition="aws",
audited_identity_arn=None,
profile=None,
profile_region=None,
credentials=None,
assumed_role_info=None,
audited_regions=[AWS_REGION],
organizations_metadata=None,
audit_resources=None,
mfa_enabled=False,
audit_metadata=Audit_Metadata(
services_scanned=0,
expected_checks=[],
completed_checks=0,
audit_progress=0,
),
)
@mock_ec2
def test_no_ebs_snapshot_no_lifecycle_policies(self):
# DLM Mock Client
@@ -85,8 +53,8 @@ class Test_dlm_ebs_snapshot_lifecycle_policy_exists:
@mock_ec2
def test_one_ebs_snapshot_and_dlm_lifecycle_policy(self):
# Generate EC2 Client
ec2_client = client("ec2", region_name=AWS_REGION)
ec2_resource = resource("ec2", region_name=AWS_REGION)
ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1)
ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1)
# Create EC2 Volume and Snapshot
volume_id = ec2_resource.create_volume(
AvailabilityZone="us-east-1a",
@@ -110,7 +78,7 @@ class Test_dlm_ebs_snapshot_lifecycle_policy_exists:
dlm_client.audited_account = AWS_ACCOUNT_NUMBER
dlm_client.audited_account_arn = AWS_ACCOUNT_ARN
dlm_client.lifecycle_policies = {
AWS_REGION: {
AWS_REGION_EU_WEST_1: {
LIFECYCLE_POLICY_ID: LifecyclePolicy(
id=LIFECYCLE_POLICY_ID,
state="ENABLED",
@@ -143,15 +111,15 @@ class Test_dlm_ebs_snapshot_lifecycle_policy_exists:
assert len(result) == 1
assert result[0].status == "PASS"
assert result[0].status_extended == "EBS snapshot lifecycle policies found."
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].resource_id == AWS_ACCOUNT_NUMBER
assert result[0].resource_arn == AWS_ACCOUNT_ARN
@mock_ec2
def test_one_ebs_snapshot_and_no_dlm_lifecycle_policy(self):
# Generate EC2 Client
ec2_client = client("ec2", region_name=AWS_REGION)
ec2_resource = resource("ec2", region_name=AWS_REGION)
ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1)
ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1)
# Create EC2 Volume and Snapshot
volume_id = ec2_resource.create_volume(
AvailabilityZone="us-east-1a",
@@ -207,7 +175,7 @@ class Test_dlm_ebs_snapshot_lifecycle_policy_exists:
dlm_client.audited_account = AWS_ACCOUNT_NUMBER
dlm_client.audited_account_arn = AWS_ACCOUNT_ARN
dlm_client.lifecycle_policies = {
AWS_REGION: {
AWS_REGION_EU_WEST_1: {
LIFECYCLE_POLICY_ID: LifecyclePolicy(
id=LIFECYCLE_POLICY_ID,
state="ENABLED",
@@ -1,18 +1,15 @@
import botocore
from boto3 import session
from mock import patch
from prowler.providers.aws.lib.audit_info.models import AWS_Audit_Info
from prowler.providers.aws.services.dlm.dlm_service import DLM, LifecyclePolicy
from prowler.providers.common.models import Audit_Metadata
from tests.providers.aws.audit_info_utils import (
AWS_ACCOUNT_NUMBER,
AWS_REGION_EU_WEST_1,
set_mocked_aws_audit_info,
)
AWS_ACCOUNT_NUMBER = "123456789012"
AWS_ACCOUNT_ARN = f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root"
AWS_REGION = "us-east-1"
LIFECYCLE_POLICY_ID = "policy-XXXXXXXXXXXX"
@@ -45,9 +42,11 @@ def mock_make_api_call(self, operation_name, kwargs):
def mock_generate_regional_clients(service, audit_info, _):
regional_client = audit_info.audit_session.client(service, region_name=AWS_REGION)
regional_client.region = AWS_REGION
return {AWS_REGION: regional_client}
regional_client = audit_info.audit_session.client(
service, region_name=AWS_REGION_EU_WEST_1
)
regional_client.region = AWS_REGION_EU_WEST_1
return {AWS_REGION_EU_WEST_1: regional_client}
@patch(
@@ -57,36 +56,6 @@ def mock_generate_regional_clients(service, audit_info, _):
# Patch every AWS call using Boto3
@patch("botocore.client.BaseClient._make_api_call", new=mock_make_api_call)
class Test_DLM_Service:
def set_mocked_audit_info(self):
audit_info = AWS_Audit_Info(
session_config=None,
original_session=None,
audit_session=session.Session(
profile_name=None,
botocore_session=None,
),
audited_account=AWS_ACCOUNT_NUMBER,
audited_account_arn=AWS_ACCOUNT_ARN,
audited_user_id=None,
audited_partition="aws",
audited_identity_arn=None,
profile=None,
profile_region=None,
credentials=None,
assumed_role_info=None,
audited_regions=None,
organizations_metadata=None,
audit_resources=None,
mfa_enabled=False,
audit_metadata=Audit_Metadata(
services_scanned=0,
expected_checks=[],
completed_checks=0,
audit_progress=0,
),
)
return audit_info
# Test DLM Service
def test_service(self):
audit_info = set_mocked_aws_audit_info([AWS_REGION_EU_WEST_1])
@@ -117,7 +86,7 @@ class Test_DLM_Service:
audit_info = set_mocked_aws_audit_info([AWS_REGION_EU_WEST_1])
dlm = DLM(audit_info)
assert dlm.lifecycle_policies == {
AWS_REGION: {
AWS_REGION_EU_WEST_1: {
LIFECYCLE_POLICY_ID: LifecyclePolicy(
id=LIFECYCLE_POLICY_ID,
state="ENABLED",
@@ -1,13 +1,14 @@
from unittest import mock
from prowler.providers.aws.services.documentdb.documentdb_service import Instance
AWS_ACCOUNT_NUMBER = "123456789012"
AWS_REGION = "us-east-1"
from tests.providers.aws.audit_info_utils import (
AWS_ACCOUNT_NUMBER,
AWS_REGION_EU_WEST_1,
)
DOC_DB_INSTANCE_NAME = "test-db"
DOC_DB_INSTANCE_ARN = (
f"arn:aws:rds:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:db:{DOC_DB_INSTANCE_NAME}"
f"arn:aws:rds:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:db:{DOC_DB_INSTANCE_NAME}"
)
DOC_DB_ENGINE_VERSION = "5.0.0"
@@ -41,7 +42,7 @@ class Test_documentdb_instance_storage_encrypted:
public=False,
encrypted=False,
auto_minor_version_upgrade=False,
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
)
}
@@ -61,7 +62,7 @@ class Test_documentdb_instance_storage_encrypted:
result[0].status_extended
== f"DocumentDB Instance {DOC_DB_INSTANCE_NAME} is not encrypted."
)
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].resource_id == DOC_DB_INSTANCE_NAME
assert result[0].resource_arn == DOC_DB_INSTANCE_ARN
@@ -77,7 +78,7 @@ class Test_documentdb_instance_storage_encrypted:
public=False,
encrypted=True,
auto_minor_version_upgrade=False,
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
)
}
with mock.patch(
@@ -95,6 +96,6 @@ class Test_documentdb_instance_storage_encrypted:
result[0].status_extended
== f"DocumentDB Instance {DOC_DB_INSTANCE_NAME} is encrypted."
)
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].resource_id == DOC_DB_INSTANCE_NAME
assert result[0].resource_arn == DOC_DB_INSTANCE_ARN
@@ -1,26 +1,23 @@
import botocore
from boto3 import session
from mock import patch
from prowler.providers.aws.lib.audit_info.models import AWS_Audit_Info
from prowler.providers.aws.services.documentdb.documentdb_service import (
DocumentDB,
Instance,
)
from prowler.providers.common.models import Audit_Metadata
from tests.providers.aws.audit_info_utils import (
AWS_ACCOUNT_NUMBER,
AWS_REGION_EU_WEST_1,
set_mocked_aws_audit_info,
)
AWS_ACCOUNT_NUMBER = "123456789012"
AWS_ACCOUNT_ARN = f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root"
AWS_REGION = "us-east-1"
DOC_DB_CLUSTER_ID = "test-cluster"
DOC_DB_INSTANCE_NAME = "test-db"
DOC_DB_INSTANCE_ARN = (
f"arn:aws:rds:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:db:{DOC_DB_INSTANCE_NAME}"
f"arn:aws:rds:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:db:{DOC_DB_INSTANCE_NAME}"
)
DOC_DB_ENGINE_VERSION = "5.0.0"
@@ -65,9 +62,11 @@ def mock_make_api_call(self, operation_name, kwargs):
def mock_generate_regional_clients(service, audit_info, _):
regional_client = audit_info.audit_session.client(service, region_name=AWS_REGION)
regional_client.region = AWS_REGION
return {AWS_REGION: regional_client}
regional_client = audit_info.audit_session.client(
service, region_name=AWS_REGION_EU_WEST_1
)
regional_client.region = AWS_REGION_EU_WEST_1
return {AWS_REGION_EU_WEST_1: regional_client}
@patch(
@@ -77,36 +76,6 @@ def mock_generate_regional_clients(service, audit_info, _):
# Patch every AWS call using Boto3
@patch("botocore.client.BaseClient._make_api_call", new=mock_make_api_call)
class Test_DocumentDB_Service:
def set_mocked_audit_info(self):
audit_info = AWS_Audit_Info(
session_config=None,
original_session=None,
audit_session=session.Session(
profile_name=None,
botocore_session=None,
),
audited_account=AWS_ACCOUNT_NUMBER,
audited_account_arn=AWS_ACCOUNT_ARN,
audited_user_id=None,
audited_partition="aws",
audited_identity_arn=None,
profile=None,
profile_region=None,
credentials=None,
assumed_role_info=None,
audited_regions=None,
organizations_metadata=None,
audit_resources=None,
mfa_enabled=False,
audit_metadata=Audit_Metadata(
services_scanned=0,
expected_checks=[],
completed_checks=0,
audit_progress=0,
),
)
return audit_info
# Test DocumentDB Service
def test_service(self):
audit_info = set_mocked_aws_audit_info([AWS_REGION_EU_WEST_1])
@@ -145,7 +114,7 @@ class Test_DocumentDB_Service:
public=False,
encrypted=False,
cluster_id=DOC_DB_CLUSTER_ID,
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
tags=[{"Key": "environment", "Value": "test"}],
)
}
@@ -1,10 +1,12 @@
from unittest import mock
from prowler.providers.aws.services.drs.drs_service import DRSservice, Job
from tests.providers.aws.audit_info_utils import (
AWS_ACCOUNT_NUMBER,
AWS_REGION_EU_WEST_1,
)
AWS_REGION = "eu-west-1"
JOB_ARN = "arn:aws:drs:eu-west-1:123456789012:job/12345678901234567890123456789012"
AWS_ACCOUNT_NUMBER = "123456789012"
class Test_drs_job_exist:
@@ -12,18 +14,18 @@ class Test_drs_job_exist:
drs_client = mock.MagicMock
drs_client.audited_account = AWS_ACCOUNT_NUMBER
drs_client.audited_account_arn = f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root"
drs_client.region = AWS_REGION
drs_client.region = AWS_REGION_EU_WEST_1
drs_client.drs_services = [
DRSservice(
id="DRS",
status="ENABLED",
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
jobs=[
Job(
arn=JOB_ARN,
id="12345678901234567890123456789012",
status="COMPLETED",
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
tags=[{"Key": "Name", "Value": "test"}],
)
],
@@ -48,19 +50,19 @@ class Test_drs_job_exist:
)
assert result[0].resource_id == AWS_ACCOUNT_NUMBER
assert result[0].resource_arn == f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root"
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].resource_tags == []
def test_drs_no_jobs(self):
drs_client = mock.MagicMock
drs_client.audited_account = AWS_ACCOUNT_NUMBER
drs_client.audited_account_arn = f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root"
drs_client.region = AWS_REGION
drs_client.region = AWS_REGION_EU_WEST_1
drs_client.drs_services = [
DRSservice(
id="DRS",
status="ENABLED",
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
jobs=[],
)
]
@@ -84,19 +86,19 @@ class Test_drs_job_exist:
)
assert result[0].resource_id == AWS_ACCOUNT_NUMBER
assert result[0].resource_arn == f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root"
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].resource_tags == []
def test_drs_disabled(self):
drs_client = mock.MagicMock
drs_client.audited_account = AWS_ACCOUNT_NUMBER
drs_client.audited_account_arn = f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root"
drs_client.region = AWS_REGION
drs_client.region = AWS_REGION_EU_WEST_1
drs_client.drs_services = [
DRSservice(
id="DRS",
status="DISABLED",
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
jobs=[],
)
]
@@ -117,7 +119,7 @@ class Test_drs_job_exist:
assert result[0].status_extended == "DRS is not enabled for this region."
assert result[0].resource_id == AWS_ACCOUNT_NUMBER
assert result[0].resource_arn == f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root"
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].resource_tags == []
def test_drs_disabled_allowlisted(self):
@@ -130,7 +132,7 @@ class Test_drs_job_exist:
DRSservice(
id="DRS",
status="DISABLED",
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
jobs=[],
)
]
@@ -151,5 +153,5 @@ class Test_drs_job_exist:
assert result[0].status_extended == "DRS is not enabled for this region."
assert result[0].resource_id == AWS_ACCOUNT_NUMBER
assert result[0].resource_arn == f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root"
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].resource_tags == []
@@ -2,18 +2,15 @@ from datetime import datetime
from unittest.mock import patch
import botocore
from boto3 import session
from prowler.providers.aws.lib.audit_info.audit_info import AWS_Audit_Info
from prowler.providers.aws.services.drs.drs_service import DRS
from prowler.providers.common.models import Audit_Metadata
from tests.providers.aws.audit_info_utils import (
AWS_REGION_EU_WEST_1,
set_mocked_aws_audit_info,
)
# Mock Test Region
AWS_REGION = "us-east-1"
# Mocking Calls
make_api_call = botocore.client.BaseClient._make_api_call
@@ -48,9 +45,11 @@ def mock_make_api_call(self, operation_name, kwargs):
def mock_generate_regional_clients(service, audit_info, _):
regional_client = audit_info.audit_session.client(service, region_name=AWS_REGION)
regional_client.region = AWS_REGION
return {AWS_REGION: regional_client}
regional_client = audit_info.audit_session.client(
service, region_name=AWS_REGION_EU_WEST_1
)
regional_client.region = AWS_REGION_EU_WEST_1
return {AWS_REGION_EU_WEST_1: regional_client}
# Patch every AWS call using Boto3 and generate_regional_clients to have 1 client
@@ -60,40 +59,10 @@ def mock_generate_regional_clients(service, audit_info, _):
new=mock_generate_regional_clients,
)
class Test_DRS_Service:
def set_mocked_audit_info(self):
audit_info = AWS_Audit_Info(
session_config=None,
original_session=None,
audit_session=session.Session(
profile_name=None,
botocore_session=None,
),
audited_account=None,
audited_account_arn=None,
audited_user_id=None,
audited_partition="aws",
audited_identity_arn=None,
profile=None,
profile_region=None,
credentials=None,
assumed_role_info=None,
audited_regions=None,
organizations_metadata=None,
audit_resources=None,
mfa_enabled=False,
audit_metadata=Audit_Metadata(
services_scanned=0,
expected_checks=[],
completed_checks=0,
audit_progress=0,
),
)
return audit_info
def test__get_client__(self):
audit_info = set_mocked_aws_audit_info([AWS_REGION_EU_WEST_1])
drs = DRS(audit_info)
assert drs.regional_clients[AWS_REGION].__class__.__name__ == "drs"
assert drs.regional_clients[AWS_REGION_EU_WEST_1].__class__.__name__ == "drs"
def test__get_service__(self):
audit_info = set_mocked_aws_audit_info([AWS_REGION_EU_WEST_1])
@@ -105,5 +74,5 @@ class Test_DRS_Service:
drs = DRS(audit_info)
assert len(drs.drs_services) == 1
assert drs.drs_services[0].id == "DRS"
assert drs.drs_services[0].region == AWS_REGION
assert drs.drs_services[0].region == AWS_REGION_EU_WEST_1
assert drs.drs_services[0].status == "ENABLED"
@@ -1,52 +1,17 @@
from re import search
from unittest import mock
from boto3 import client, session
from boto3 import client
from moto import mock_dax
from moto.core import DEFAULT_ACCOUNT_ID
from prowler.providers.aws.lib.audit_info.models import AWS_Audit_Info
from prowler.providers.common.models import Audit_Metadata
from tests.providers.aws.audit_info_utils import (
AWS_REGION_EU_WEST_1,
set_mocked_aws_audit_info,
)
AWS_REGION = "us-east-1"
class Test_dynamodb_accelerator_cluster_encryption_enabled:
def set_mocked_audit_info(self):
audit_info = AWS_Audit_Info(
session_config=None,
original_session=None,
audit_session=session.Session(
profile_name=None,
botocore_session=None,
),
audited_account=DEFAULT_ACCOUNT_ID,
audited_account_arn=f"arn:aws:iam::{DEFAULT_ACCOUNT_ID}:root",
audited_user_id=None,
audited_partition="aws",
audited_identity_arn=None,
profile=None,
profile_region=None,
credentials=None,
assumed_role_info=None,
audited_regions=["us-east-1", "eu-west-1"],
organizations_metadata=None,
audit_resources=None,
mfa_enabled=False,
audit_metadata=Audit_Metadata(
services_scanned=0,
expected_checks=[],
completed_checks=0,
audit_progress=0,
),
)
return audit_info
@mock_dax
def test_dax_no_clusters(self):
from prowler.providers.aws.services.dynamodb.dynamodb_service import DAX
@@ -72,7 +37,7 @@ class Test_dynamodb_accelerator_cluster_encryption_enabled:
@mock_dax
def test_dax_cluster_no_encryption(self):
dax_client = client("dax", region_name=AWS_REGION)
dax_client = client("dax", region_name=AWS_REGION_EU_WEST_1)
iam_role_arn = f"arn:aws:iam::{DEFAULT_ACCOUNT_ID}:role/aws-service-role/dax.amazonaws.com/AWSServiceRoleForDAX"
cluster = dax_client.create_cluster(
ClusterName="daxcluster",
@@ -107,12 +72,12 @@ class Test_dynamodb_accelerator_cluster_encryption_enabled:
)
assert result[0].resource_id == cluster["ClusterName"]
assert result[0].resource_arn == cluster["ClusterArn"]
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].resource_tags == []
@mock_dax
def test_dax_cluster_with_encryption(self):
dax_client = client("dax", region_name=AWS_REGION)
dax_client = client("dax", region_name=AWS_REGION_EU_WEST_1)
iam_role_arn = f"arn:aws:iam::{DEFAULT_ACCOUNT_ID}:role/aws-service-role/dax.amazonaws.com/AWSServiceRoleForDAX"
cluster = dax_client.create_cluster(
ClusterName="daxcluster",
@@ -145,5 +110,5 @@ class Test_dynamodb_accelerator_cluster_encryption_enabled:
assert search("has encryption at rest enabled", result[0].status_extended)
assert result[0].resource_id == cluster["ClusterName"]
assert result[0].resource_arn == cluster["ClusterArn"]
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].resource_tags == []
@@ -1,49 +1,15 @@
from boto3 import client, session
from boto3 import client
from moto import mock_dax, mock_dynamodb
from prowler.providers.aws.lib.audit_info.models import AWS_Audit_Info
from prowler.providers.aws.services.dynamodb.dynamodb_service import DAX, DynamoDB
from prowler.providers.common.models import Audit_Metadata
from tests.providers.aws.audit_info_utils import (
AWS_ACCOUNT_NUMBER,
AWS_REGION_EU_WEST_1,
set_mocked_aws_audit_info,
)
AWS_ACCOUNT_NUMBER = "123456789012"
AWS_REGION = "us-east-1"
class Test_DynamoDB_Service:
def set_mocked_audit_info(self):
audit_info = AWS_Audit_Info(
session_config=None,
original_session=None,
audit_session=session.Session(
profile_name=None,
botocore_session=None,
),
audited_account=AWS_ACCOUNT_NUMBER,
audited_account_arn=f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root",
audited_user_id=None,
audited_partition="aws",
audited_identity_arn=None,
profile=None,
profile_region=None,
credentials=None,
assumed_role_info=None,
audited_regions=None,
organizations_metadata=None,
audit_resources=None,
mfa_enabled=False,
audit_metadata=Audit_Metadata(
services_scanned=0,
expected_checks=[],
completed_checks=0,
audit_progress=0,
),
)
return audit_info
# Test Dynamo Service
@mock_dynamodb
def test_service(self):
@@ -81,7 +47,7 @@ class Test_DynamoDB_Service:
@mock_dynamodb
def test__list_tables__(self):
# Generate DynamoDB Client
dynamodb_client = client("dynamodb", region_name=AWS_REGION)
dynamodb_client = client("dynamodb", region_name=AWS_REGION_EU_WEST_1)
# Create DynamoDB Tables
dynamodb_client.create_table(
TableName="test1",
@@ -113,14 +79,14 @@ class Test_DynamoDB_Service:
assert len(dynamo.tables) == 2
assert dynamo.tables[0].name == "test1"
assert dynamo.tables[1].name == "test2"
assert dynamo.tables[0].region == AWS_REGION
assert dynamo.tables[1].region == AWS_REGION
assert dynamo.tables[0].region == AWS_REGION_EU_WEST_1
assert dynamo.tables[1].region == AWS_REGION_EU_WEST_1
# Test DynamoDB Describe Table
@mock_dynamodb
def test__describe_table__(self):
# Generate DynamoDB Client
dynamodb_client = client("dynamodb", region_name=AWS_REGION)
dynamodb_client = client("dynamodb", region_name=AWS_REGION_EU_WEST_1)
# Create DynamoDB Table
table = dynamodb_client.create_table(
TableName="test1",
@@ -143,7 +109,7 @@ class Test_DynamoDB_Service:
assert len(dynamo.tables) == 1
assert dynamo.tables[0].arn == table["TableArn"]
assert dynamo.tables[0].name == "test1"
assert dynamo.tables[0].region == AWS_REGION
assert dynamo.tables[0].region == AWS_REGION_EU_WEST_1
assert dynamo.tables[0].tags == [
{"Key": "test", "Value": "test"},
]
@@ -152,7 +118,7 @@ class Test_DynamoDB_Service:
@mock_dynamodb
def test__describe_continuous_backups__(self):
# Generate DynamoDB Client
dynamodb_client = client("dynamodb", region_name=AWS_REGION)
dynamodb_client = client("dynamodb", region_name=AWS_REGION_EU_WEST_1)
# Create DynamoDB Table
table = dynamodb_client.create_table(
TableName="test1",
@@ -177,13 +143,13 @@ class Test_DynamoDB_Service:
assert dynamo.tables[0].arn == table["TableArn"]
assert dynamo.tables[0].name == "test1"
assert dynamo.tables[0].pitr
assert dynamo.tables[0].region == AWS_REGION
assert dynamo.tables[0].region == AWS_REGION_EU_WEST_1
# Test DAX Describe Clusters
@mock_dax
def test__describe_clusters__(self):
# Generate DAX Client
dax_client = client("dax", region_name=AWS_REGION)
dax_client = client("dax", region_name=AWS_REGION_EU_WEST_1)
# Create DAX Clusters
iam_role_arn = f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:role/aws-service-role/dax.amazonaws.com/AWSServiceRoleForDAX"
dax_client.create_cluster(
@@ -212,14 +178,14 @@ class Test_DynamoDB_Service:
assert len(dax.clusters) == 2
assert dax.clusters[0].name == "daxcluster1"
assert dax.clusters[0].region == AWS_REGION
assert dax.clusters[0].region == AWS_REGION_EU_WEST_1
assert dax.clusters[0].encryption
assert dax.clusters[0].tags == [
{"Key": "test", "Value": "test"},
]
assert dax.clusters[1].name == "daxcluster2"
assert dax.clusters[1].region == AWS_REGION
assert dax.clusters[1].region == AWS_REGION_EU_WEST_1
assert dax.clusters[1].encryption
assert dax.clusters[1].tags == [
{"Key": "test", "Value": "test"},
@@ -9,9 +9,6 @@ from tests.providers.aws.audit_info_utils import (
set_mocked_aws_audit_info,
)
AWS_REGION = "us-east-1"
AWS_ACCOUNT_NUMBER = "123456789012"
class Test_dynamodb_tables_kms_cmk_encryption_enabled:
@mock_dynamodb
@@ -39,7 +36,7 @@ class Test_dynamodb_tables_kms_cmk_encryption_enabled:
@mock_dynamodb
def test_dynamodb_table_kms_encryption(self):
dynamodb_client = client("dynamodb", region_name=AWS_REGION)
dynamodb_client = client("dynamodb", region_name=AWS_REGION_EU_WEST_1)
table = dynamodb_client.create_table(
TableName="test1",
AttributeDefinitions=[
@@ -77,12 +74,12 @@ class Test_dynamodb_tables_kms_cmk_encryption_enabled:
assert search("KMS encryption enabled", result[0].status_extended)
assert result[0].resource_id == table["TableName"]
assert result[0].resource_arn == table["TableArn"]
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].resource_tags == []
@mock_dynamodb
def test_dynamodb_table_default_encryption(self):
dynamodb_client = client("dynamodb", region_name=AWS_REGION)
dynamodb_client = client("dynamodb", region_name=AWS_REGION_EU_WEST_1)
table = dynamodb_client.create_table(
TableName="test1",
AttributeDefinitions=[
@@ -119,5 +116,5 @@ class Test_dynamodb_tables_kms_cmk_encryption_enabled:
assert search("DEFAULT encryption enabled", result[0].status_extended)
assert result[0].resource_id == table["TableName"]
assert result[0].resource_arn == table["TableArn"]
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].resource_tags == []
@@ -9,9 +9,6 @@ from tests.providers.aws.audit_info_utils import (
set_mocked_aws_audit_info,
)
AWS_REGION = "us-east-1"
AWS_ACCOUNT_NUMBER = "123456789012"
class Test_dynamodb_tables_pitr_enabled:
@mock_dynamodb
@@ -39,7 +36,7 @@ class Test_dynamodb_tables_pitr_enabled:
@mock_dynamodb
def test_dynamodb_table_no_pitr(self):
dynamodb_client = client("dynamodb", region_name=AWS_REGION)
dynamodb_client = client("dynamodb", region_name=AWS_REGION_EU_WEST_1)
table = dynamodb_client.create_table(
TableName="test1",
AttributeDefinitions=[
@@ -79,12 +76,12 @@ class Test_dynamodb_tables_pitr_enabled:
)
assert result[0].resource_id == table["TableName"]
assert result[0].resource_arn == table["TableArn"]
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].resource_tags == []
@mock_dynamodb
def test_dynamodb_table_with_pitr(self):
dynamodb_client = client("dynamodb", region_name=AWS_REGION)
dynamodb_client = client("dynamodb", region_name=AWS_REGION_EU_WEST_1)
table = dynamodb_client.create_table(
TableName="test1",
AttributeDefinitions=[
@@ -127,5 +124,5 @@ class Test_dynamodb_tables_pitr_enabled:
)
assert result[0].resource_id == table["TableName"]
assert result[0].resource_arn == table["TableArn"]
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].resource_tags == []
@@ -8,9 +8,7 @@ from tests.providers.aws.audit_info_utils import (
set_mocked_aws_audit_info,
)
AWS_REGION = "us-east-1"
EXAMPLE_AMI_ID = "ami-12c6146b"
AWS_ACCOUNT_NUMBER = "123456789012"
class Test_ec2_ami_public:
@@ -39,7 +37,7 @@ class Test_ec2_ami_public:
@mock_ec2
def test_one_private_ami(self):
ec2 = client("ec2", region_name=AWS_REGION)
ec2 = client("ec2", region_name=AWS_REGION_EU_WEST_1)
reservation = ec2.run_instances(ImageId=EXAMPLE_AMI_ID, MinCount=1, MaxCount=1)
instance = reservation["Instances"][0]
@@ -73,14 +71,14 @@ class Test_ec2_ami_public:
assert result[0].resource_id == image_id
assert (
result[0].resource_arn
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:image/{image_id}"
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION_EU_WEST_1}:{current_audit_info.audited_account}:image/{image_id}"
)
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].resource_tags == []
@mock_ec2
def test_one_public_ami(self):
ec2 = client("ec2", region_name=AWS_REGION)
ec2 = client("ec2", region_name=AWS_REGION_EU_WEST_1)
reservation = ec2.run_instances(ImageId=EXAMPLE_AMI_ID, MinCount=1, MaxCount=1)
instance = reservation["Instances"][0]
@@ -125,7 +123,7 @@ class Test_ec2_ami_public:
assert result[0].resource_id == image_id
assert (
result[0].resource_arn
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:image/{image_id}"
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION_EU_WEST_1}:{current_audit_info.audited_account}:image/{image_id}"
)
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].resource_tags == []
@@ -4,20 +4,19 @@ from boto3 import client, resource
from moto import mock_ec2
from tests.providers.aws.audit_info_utils import (
AWS_ACCOUNT_NUMBER,
AWS_REGION_EU_WEST_1,
set_mocked_aws_audit_info,
)
AWS_REGION = "us-east-1"
EXAMPLE_AMI_ID = "ami-12c6146b"
AWS_ACCOUNT_NUMBER = "123456789012"
class Test_ec2_ebs_default_encryption:
@mock_ec2
def test_ec2_ebs_encryption_enabled(self):
# Create EC2 Mocked Resources
ec2_client = client("ec2", region_name=AWS_REGION)
ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1)
ec2_client.enable_ebs_encryption_by_default()
from prowler.providers.aws.services.ec2.ec2_service import EC2
@@ -42,7 +41,7 @@ class Test_ec2_ebs_default_encryption:
# One result per region
assert len(results) == 2
for result in results:
if result.region == AWS_REGION:
if result.region == AWS_REGION_EU_WEST_1:
assert result.status == "PASS"
assert (
result.status_extended == "EBS Default Encryption is activated."
@@ -110,8 +109,8 @@ class Test_ec2_ebs_default_encryption:
@mock_ec2
def test_ec2_ebs_encryption_disabled_ignoring_with_volumes(self):
# Create EC2 Mocked Resources
ec2 = resource("ec2", region_name=AWS_REGION)
ec2.create_volume(Size=36, AvailabilityZone=f"{AWS_REGION}a")
ec2 = resource("ec2", region_name=AWS_REGION_EU_WEST_1)
ec2.create_volume(Size=36, AvailabilityZone=f"{AWS_REGION_EU_WEST_1}a")
from prowler.providers.aws.services.ec2.ec2_service import EC2
current_audit_info = set_mocked_aws_audit_info([AWS_REGION_EU_WEST_1])
@@ -134,7 +133,7 @@ class Test_ec2_ebs_default_encryption:
# One result per region
assert len(result) == 1
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].status == "FAIL"
assert (
result[0].status_extended == "EBS Default Encryption is not activated."
@@ -9,14 +9,13 @@ from tests.providers.aws.audit_info_utils import (
set_mocked_aws_audit_info,
)
AWS_REGION = "us-east-1"
AWS_ACCOUNT_NUMBER = "123456789012"
def mock_generate_regional_clients(service, audit_info, _):
regional_client = audit_info.audit_session.client(service, region_name=AWS_REGION)
regional_client.region = AWS_REGION
return {AWS_REGION: regional_client}
regional_client = audit_info.audit_session.client(
service, region_name=AWS_REGION_EU_WEST_1
)
regional_client.region = AWS_REGION_EU_WEST_1
return {AWS_REGION_EU_WEST_1: regional_client}
@patch(
@@ -51,9 +50,9 @@ class Test_ec2_ebs_public_snapshot:
@mock_ec2
def test_ec2_public_snapshot(self):
# Create EC2 Mocked Resources
ec2 = resource("ec2", region_name=AWS_REGION)
ec2_client = client("ec2", region_name=AWS_REGION)
volume = ec2.create_volume(Size=80, AvailabilityZone=f"{AWS_REGION}a")
ec2 = resource("ec2", region_name=AWS_REGION_EU_WEST_1)
ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1)
volume = ec2.create_volume(Size=80, AvailabilityZone=f"{AWS_REGION_EU_WEST_1}a")
snapshot = volume.create_snapshot(Description="testsnap")
ec2_client.modify_snapshot_attribute(
SnapshotId=snapshot.id,
@@ -86,7 +85,7 @@ class Test_ec2_ebs_public_snapshot:
for snap in results:
if snap.resource_id == snapshot.id:
assert snap.region == AWS_REGION
assert snap.region == AWS_REGION_EU_WEST_1
assert snap.resource_tags == []
assert snap.status == "FAIL"
assert (
@@ -95,15 +94,15 @@ class Test_ec2_ebs_public_snapshot:
)
assert (
snap.resource_arn
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:snapshot/{snapshot.id}"
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION_EU_WEST_1}:{current_audit_info.audited_account}:snapshot/{snapshot.id}"
)
@mock_ec2
def test_ec2_private_snapshot(self):
# Create EC2 Mocked Resources
ec2 = resource("ec2", region_name=AWS_REGION)
ec2 = resource("ec2", region_name=AWS_REGION_EU_WEST_1)
snapshot = volume = ec2.create_volume(
Size=80, AvailabilityZone=f"{AWS_REGION}a", Encrypted=True
Size=80, AvailabilityZone=f"{AWS_REGION_EU_WEST_1}a", Encrypted=True
)
snapshot = volume.create_snapshot(Description="testsnap")
@@ -131,7 +130,7 @@ class Test_ec2_ebs_public_snapshot:
for snap in results:
if snap.resource_id == snapshot.id:
assert snap.region == AWS_REGION
assert snap.region == AWS_REGION_EU_WEST_1
assert snap.resource_tags == []
assert snap.status == "PASS"
assert (
@@ -140,5 +139,5 @@ class Test_ec2_ebs_public_snapshot:
)
assert (
snap.resource_arn
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:snapshot/{snapshot.id}"
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION_EU_WEST_1}:{current_audit_info.audited_account}:snapshot/{snapshot.id}"
)
@@ -9,14 +9,13 @@ from tests.providers.aws.audit_info_utils import (
set_mocked_aws_audit_info,
)
AWS_REGION = "us-east-1"
AWS_ACCOUNT_NUMBER = "123456789012"
def mock_generate_regional_clients(service, audit_info, _):
regional_client = audit_info.audit_session.client(service, region_name=AWS_REGION)
regional_client.region = AWS_REGION
return {AWS_REGION: regional_client}
regional_client = audit_info.audit_session.client(
service, region_name=AWS_REGION_EU_WEST_1
)
regional_client.region = AWS_REGION_EU_WEST_1
return {AWS_REGION_EU_WEST_1: regional_client}
@patch(
@@ -51,8 +50,8 @@ class Test_ec2_ebs_snapshots_encrypted:
@mock_ec2
def test_ec2_unencrypted_snapshot(self):
# Create EC2 Mocked Resources
ec2 = resource("ec2", region_name=AWS_REGION)
volume = ec2.create_volume(Size=80, AvailabilityZone=f"{AWS_REGION}a")
ec2 = resource("ec2", region_name=AWS_REGION_EU_WEST_1)
volume = ec2.create_volume(Size=80, AvailabilityZone=f"{AWS_REGION_EU_WEST_1}a")
snapshot = volume.create_snapshot(Description="testsnap")
from prowler.providers.aws.services.ec2.ec2_service import EC2
@@ -79,7 +78,7 @@ class Test_ec2_ebs_snapshots_encrypted:
for snap in results:
if snap.resource_id == snapshot.id:
assert snap.region == AWS_REGION
assert snap.region == AWS_REGION_EU_WEST_1
assert snap.resource_tags == []
assert snap.status == "FAIL"
assert (
@@ -88,15 +87,15 @@ class Test_ec2_ebs_snapshots_encrypted:
)
assert (
snap.resource_arn
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:snapshot/{snapshot.id}"
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION_EU_WEST_1}:{current_audit_info.audited_account}:snapshot/{snapshot.id}"
)
@mock_ec2
def test_ec2_encrypted_snapshot(self):
# Create EC2 Mocked Resources
ec2 = resource("ec2", region_name=AWS_REGION)
ec2 = resource("ec2", region_name=AWS_REGION_EU_WEST_1)
snapshot = volume = ec2.create_volume(
Size=80, AvailabilityZone=f"{AWS_REGION}a", Encrypted=True
Size=80, AvailabilityZone=f"{AWS_REGION_EU_WEST_1}a", Encrypted=True
)
snapshot = volume.create_snapshot(Description="testsnap")
@@ -124,7 +123,7 @@ class Test_ec2_ebs_snapshots_encrypted:
for snap in results:
if snap.resource_id == snapshot.id:
assert snap.region == AWS_REGION
assert snap.region == AWS_REGION_EU_WEST_1
assert snap.resource_tags == []
assert snap.status == "PASS"
assert (
@@ -133,5 +132,5 @@ class Test_ec2_ebs_snapshots_encrypted:
)
assert (
snap.resource_arn
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:snapshot/{snapshot.id}"
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION_EU_WEST_1}:{current_audit_info.audited_account}:snapshot/{snapshot.id}"
)
@@ -8,9 +8,6 @@ from tests.providers.aws.audit_info_utils import (
set_mocked_aws_audit_info,
)
AWS_REGION = "us-east-1"
AWS_ACCOUNT_NUMBER = "123456789012"
class Test_ec2_ebs_volume_encryption:
@mock_ec2
@@ -39,8 +36,8 @@ class Test_ec2_ebs_volume_encryption:
@mock_ec2
def test_ec2_unencrypted_volume(self):
# Create EC2 Mocked Resources
ec2 = resource("ec2", region_name=AWS_REGION)
volume = ec2.create_volume(Size=80, AvailabilityZone=f"{AWS_REGION}a")
ec2 = resource("ec2", region_name=AWS_REGION_EU_WEST_1)
volume = ec2.create_volume(Size=80, AvailabilityZone=f"{AWS_REGION_EU_WEST_1}a")
from prowler.providers.aws.services.ec2.ec2_service import EC2
@@ -64,7 +61,7 @@ class Test_ec2_ebs_volume_encryption:
assert len(result) == 1
assert result[0].status == "FAIL"
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
# Moto creates the volume with None in the tags attribute
assert result[0].resource_tags is None
assert (
@@ -72,15 +69,15 @@ class Test_ec2_ebs_volume_encryption:
)
assert (
result[0].resource_arn
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:volume/{volume.id}"
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION_EU_WEST_1}:{current_audit_info.audited_account}:volume/{volume.id}"
)
@mock_ec2
def test_ec2_encrypted_volume(self):
# Create EC2 Mocked Resources
ec2 = resource("ec2", region_name=AWS_REGION)
ec2 = resource("ec2", region_name=AWS_REGION_EU_WEST_1)
volume = ec2.create_volume(
Size=80, AvailabilityZone=f"{AWS_REGION}a", Encrypted=True
Size=80, AvailabilityZone=f"{AWS_REGION_EU_WEST_1}a", Encrypted=True
)
from prowler.providers.aws.services.ec2.ec2_service import EC2
@@ -105,7 +102,7 @@ class Test_ec2_ebs_volume_encryption:
assert len(result) == 1
assert result[0].status == "PASS"
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
# Moto creates the volume with None in the tags attribute
assert result[0].resource_tags is None
assert (
@@ -113,5 +110,5 @@ class Test_ec2_ebs_volume_encryption:
)
assert (
result[0].resource_arn
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:volume/{volume.id}"
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION_EU_WEST_1}:{current_audit_info.audited_account}:volume/{volume.id}"
)
@@ -1,26 +1,26 @@
from unittest import mock
from boto3 import resource, session
from boto3 import resource
from mock import patch
from moto import mock_ec2
from prowler.providers.aws.lib.audit_info.models import AWS_Audit_Info
from prowler.providers.common.models import Audit_Metadata
from tests.providers.aws.audit_info_utils import (
AWS_ACCOUNT_NUMBER,
AWS_REGION_EU_WEST_1,
set_mocked_aws_audit_info,
)
AWS_REGION = "us-east-1"
AWS_REGION_AZ = "us-east-1a"
AWS_ACCOUNT_NUMBER = "123456789012"
AWS_ACCOUNT_ARN = f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root"
def mock_generate_regional_clients(service, audit_info, _):
regional_client = audit_info.audit_session.client(service, region_name=AWS_REGION)
regional_client.region = AWS_REGION
return {AWS_REGION: regional_client}
regional_client = audit_info.audit_session.client(
service, region_name=AWS_REGION_EU_WEST_1
)
regional_client.region = AWS_REGION_EU_WEST_1
return {AWS_REGION_EU_WEST_1: regional_client}
@patch(
@@ -28,37 +28,6 @@ def mock_generate_regional_clients(service, audit_info, _):
new=mock_generate_regional_clients,
)
class Test_ec2_ebs_volume_snapshots_exists:
def set_mocked_audit_info(self):
audit_info = AWS_Audit_Info(
session_config=None,
original_session=None,
audit_session=session.Session(
profile_name=None,
botocore_session=None,
),
audited_account=AWS_ACCOUNT_NUMBER,
audited_account_arn=AWS_ACCOUNT_ARN,
audited_user_id=None,
audited_partition="aws",
audited_identity_arn=None,
profile=None,
profile_region=None,
credentials=None,
assumed_role_info=None,
audited_regions=[AWS_REGION],
organizations_metadata=None,
audit_resources=None,
mfa_enabled=False,
audit_metadata=Audit_Metadata(
services_scanned=0,
expected_checks=[],
completed_checks=0,
audit_progress=0,
),
)
return audit_info
@mock_ec2
def test_no_volumes(self):
from prowler.providers.aws.services.ec2.ec2_service import EC2
@@ -84,9 +53,9 @@ class Test_ec2_ebs_volume_snapshots_exists:
@mock_ec2
def test_ec2_volume_without_snapshots(self):
ec2 = resource("ec2", region_name=AWS_REGION)
ec2 = resource("ec2", region_name=AWS_REGION_EU_WEST_1)
volume = ec2.create_volume(Size=80, AvailabilityZone=AWS_REGION_AZ)
volume_arn = f"arn:aws:ec2:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:volume/{volume.id}"
volume_arn = f"arn:aws:ec2:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:volume/{volume.id}"
from prowler.providers.aws.services.ec2.ec2_service import EC2
current_audit_info = set_mocked_aws_audit_info([AWS_REGION_EU_WEST_1])
@@ -115,14 +84,14 @@ class Test_ec2_ebs_volume_snapshots_exists:
assert result[0].resource_id == volume.id
assert result[0].resource_arn == volume_arn
assert result[0].resource_tags is None
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
@mock_ec2
def test_ec2_volume_with_snapshot(self):
# Create EC2 Mocked Resources
ec2 = resource("ec2", region_name=AWS_REGION)
ec2 = resource("ec2", region_name=AWS_REGION_EU_WEST_1)
volume = ec2.create_volume(Size=80, AvailabilityZone=AWS_REGION_AZ)
volume_arn = f"arn:aws:ec2:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:volume/{volume.id}"
volume_arn = f"arn:aws:ec2:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:volume/{volume.id}"
_ = volume.create_snapshot(Description="testsnap")
from prowler.providers.aws.services.ec2.ec2_service import EC2
@@ -153,23 +122,19 @@ class Test_ec2_ebs_volume_snapshots_exists:
assert result[0].resource_id == volume.id
assert result[0].resource_arn == volume_arn
assert result[0].resource_tags is None
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
@mock_ec2
def test_ec2_volume_with_and_without_snapshot(self):
# Create EC2 Mocked Resources
ec2 = resource("ec2", region_name=AWS_REGION)
ec2 = resource("ec2", region_name=AWS_REGION_EU_WEST_1)
volume1 = ec2.create_volume(Size=80, AvailabilityZone=AWS_REGION_AZ)
volume1_arn = (
f"arn:aws:ec2:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:volume/{volume1.id}"
)
volume1_arn = f"arn:aws:ec2:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:volume/{volume1.id}"
_ = volume1.create_snapshot(Description="test-snap")
volume2 = ec2.create_volume(Size=80, AvailabilityZone=AWS_REGION_AZ)
volume2_arn = (
f"arn:aws:ec2:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:volume/{volume2.id}"
)
volume2_arn = f"arn:aws:ec2:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:volume/{volume2.id}"
from prowler.providers.aws.services.ec2.ec2_service import EC2
@@ -201,7 +166,7 @@ class Test_ec2_ebs_volume_snapshots_exists:
assert res.resource_id == volume1.id
assert res.resource_arn == volume1_arn
assert res.resource_tags is None
assert res.region == AWS_REGION
assert res.region == AWS_REGION_EU_WEST_1
if res.resource_id == volume2.id:
assert res.status == "FAIL"
assert (
@@ -211,4 +176,4 @@ class Test_ec2_ebs_volume_snapshots_exists:
assert res.resource_id == volume2.id
assert res.resource_arn == volume2_arn
assert res.resource_tags is None
assert res.region == AWS_REGION
assert res.region == AWS_REGION_EU_WEST_1
@@ -1,63 +1,30 @@
from unittest import mock
from boto3 import client, session
from boto3 import client
from moto import mock_ec2
from prowler.providers.aws.lib.audit_info.models import AWS_Audit_Info
from prowler.providers.common.models import Audit_Metadata
from tests.providers.aws.audit_info_utils import (
AWS_ACCOUNT_NUMBER,
AWS_REGION_EU_WEST_1,
set_mocked_aws_audit_info,
)
EXAMPLE_AMI_ID = "ami-12c6146b"
AWS_ACCOUNT_NUMBER = "123456789012"
AWS_REGION = "eu-west-1"
class Test_ec2_elastic_ip_shodan:
def set_mocked_audit_info(self):
audit_info = AWS_Audit_Info(
session_config=None,
original_session=None,
audit_session=session.Session(
profile_name=None,
botocore_session=None,
),
audited_account=AWS_ACCOUNT_NUMBER,
audited_account_arn=f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root",
audited_user_id=None,
audited_partition="aws",
audited_identity_arn=None,
profile=None,
profile_region=None,
credentials=None,
assumed_role_info=None,
audited_regions=["us-east-1", "eu-west-1"],
organizations_metadata=None,
audit_resources=None,
mfa_enabled=False,
audit_metadata=Audit_Metadata(
services_scanned=0,
expected_checks=[],
completed_checks=0,
audit_progress=0,
),
audit_config={"shodan_api_key": ""},
)
return audit_info
@mock_ec2
def test_ec2_one_instances_no_public_ip(self):
# Create EC2 Mocked Resources
ec2_client = client("ec2", AWS_REGION)
ec2_client = client("ec2", AWS_REGION_EU_WEST_1)
# Create EC2 Instance
ec2_client.run_instances(ImageId=EXAMPLE_AMI_ID, MinCount=1, MaxCount=1)
from prowler.providers.aws.services.ec2.ec2_service import EC2
current_audit_info = set_mocked_aws_audit_info([AWS_REGION_EU_WEST_1])
current_audit_info = set_mocked_aws_audit_info(
[AWS_REGION_EU_WEST_1], audit_config={"shodan_api_key": ""}
)
with mock.patch(
"prowler.providers.aws.lib.audit_info.audit_info.current_audit_info",
@@ -79,13 +46,15 @@ class Test_ec2_elastic_ip_shodan:
@mock_ec2
def test_ec2_one_unattached_eip(self):
# Create EC2 Mocked Resources
ec2_client = client("ec2", AWS_REGION)
ec2_client = client("ec2", AWS_REGION_EU_WEST_1)
# Create EC2 Instance
ec2_client.allocate_address(Domain="vpc")
from prowler.providers.aws.services.ec2.ec2_service import EC2
current_audit_info = set_mocked_aws_audit_info([AWS_REGION_EU_WEST_1])
current_audit_info = set_mocked_aws_audit_info(
[AWS_REGION_EU_WEST_1], audit_config={"shodan_api_key": ""}
)
with mock.patch(
"prowler.providers.aws.lib.audit_info.audit_info.current_audit_info",
@@ -107,7 +76,7 @@ class Test_ec2_elastic_ip_shodan:
@mock_ec2
def test_ec2_one_attached_eip_no_shodan_api_key(self):
# Create EC2 Mocked Resources
ec2_client = client("ec2", AWS_REGION)
ec2_client = client("ec2", AWS_REGION_EU_WEST_1)
# Create EC2 Instance
instance = ec2_client.run_instances(
ImageId=EXAMPLE_AMI_ID, MinCount=1, MaxCount=1
@@ -120,7 +89,9 @@ class Test_ec2_elastic_ip_shodan:
from prowler.providers.aws.services.ec2.ec2_service import EC2
current_audit_info = set_mocked_aws_audit_info([AWS_REGION_EU_WEST_1])
current_audit_info = set_mocked_aws_audit_info(
[AWS_REGION_EU_WEST_1], audit_config={"shodan_api_key": ""}
)
with mock.patch(
"prowler.providers.aws.lib.audit_info.audit_info.current_audit_info",
@@ -142,7 +113,7 @@ class Test_ec2_elastic_ip_shodan:
@mock_ec2
def test_ec2_one_attached_eip_shodan_api_key(self):
# Create EC2 Mocked Resources
ec2_client = client("ec2", AWS_REGION)
ec2_client = client("ec2", AWS_REGION_EU_WEST_1)
# Create EC2 Instance
instance = ec2_client.run_instances(
ImageId=EXAMPLE_AMI_ID, MinCount=1, MaxCount=1
@@ -158,7 +129,9 @@ class Test_ec2_elastic_ip_shodan:
from prowler.providers.aws.services.ec2.ec2_service import EC2
current_audit_info = set_mocked_aws_audit_info([AWS_REGION_EU_WEST_1])
current_audit_info = set_mocked_aws_audit_info(
[AWS_REGION_EU_WEST_1], audit_config={"shodan_api_key": ""}
)
current_audit_info.audit_config = {"shodan_api_key": "XXXXXXX"}
ports = ["22", "443"]
@@ -187,9 +160,9 @@ class Test_ec2_elastic_ip_shodan:
assert result[0].resource_id == public_ip
assert (
result[0].resource_arn
== f"arn:aws:ec2:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:eip-allocation/{allocation_id}"
== f"arn:aws:ec2:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:eip-allocation/{allocation_id}"
)
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].resource_tags == []
assert result[0].status == "FAIL"
assert (
@@ -9,9 +9,7 @@ from tests.providers.aws.audit_info_utils import (
set_mocked_aws_audit_info,
)
AWS_REGION = "us-east-1"
EXAMPLE_AMI_ID = "ami-12c6146b"
AWS_ACCOUNT_NUMBER = "123456789012"
class Test_ec2_elastic_ip_unassigned:
@@ -41,7 +39,7 @@ class Test_ec2_elastic_ip_unassigned:
@mock_ec2
def test_eip_unassociated(self):
# Create EC2 Mocked Resources
ec2_client = client("ec2", region_name=AWS_REGION)
ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1)
allocation_id = ec2_client.allocate_address(
Domain="vpc", Address="127.38.43.222"
)["AllocationId"]
@@ -67,7 +65,7 @@ class Test_ec2_elastic_ip_unassigned:
assert len(results) == 1
assert results[0].status == "FAIL"
assert results[0].region == AWS_REGION
assert results[0].region == AWS_REGION_EU_WEST_1
assert results[0].resource_tags == []
assert search(
"is not associated",
@@ -75,14 +73,14 @@ class Test_ec2_elastic_ip_unassigned:
)
assert (
results[0].resource_arn
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:eip-allocation/{allocation_id}"
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION_EU_WEST_1}:{current_audit_info.audited_account}:eip-allocation/{allocation_id}"
)
@mock_ec2
def test_eip_associated(self):
# Create EC2 Mocked Resources
ec2_client = client("ec2", region_name=AWS_REGION)
ec2_resource = resource("ec2", region_name=AWS_REGION)
ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1)
ec2_resource = resource("ec2", region_name=AWS_REGION_EU_WEST_1)
reservation = ec2_client.run_instances(
ImageId=EXAMPLE_AMI_ID, MinCount=1, MaxCount=1
@@ -118,7 +116,7 @@ class Test_ec2_elastic_ip_unassigned:
assert len(results) == 1
assert results[0].status == "PASS"
assert results[0].region == AWS_REGION
assert results[0].region == AWS_REGION_EU_WEST_1
assert results[0].resource_tags == []
assert search(
"is associated",
@@ -126,5 +124,5 @@ class Test_ec2_elastic_ip_unassigned:
)
assert (
results[0].resource_arn
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:eip-allocation/{eip.allocation_id}"
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION_EU_WEST_1}:{current_audit_info.audited_account}:eip-allocation/{eip.allocation_id}"
)
@@ -8,9 +8,7 @@ from tests.providers.aws.audit_info_utils import (
set_mocked_aws_audit_info,
)
AWS_REGION = "us-east-1"
EXAMPLE_AMI_ID = "ami-12c6146b"
AWS_ACCOUNT_NUMBER = "123456789012"
class Test_ec2_instance_detailed_monitoring_enabled:
@@ -39,7 +37,7 @@ class Test_ec2_instance_detailed_monitoring_enabled:
@mock_ec2
def test_instance_with_enhanced_monitoring_disabled(self):
ec2 = resource("ec2", region_name=AWS_REGION)
ec2 = resource("ec2", region_name=AWS_REGION_EU_WEST_1)
instance = ec2.create_instances(
ImageId=EXAMPLE_AMI_ID,
MinCount=1,
@@ -67,7 +65,7 @@ class Test_ec2_instance_detailed_monitoring_enabled:
assert len(result) == 1
assert result[0].status == "FAIL"
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
# Moto fills instance tags with None
assert result[0].resource_tags is None
assert (
@@ -77,12 +75,12 @@ class Test_ec2_instance_detailed_monitoring_enabled:
assert result[0].resource_id == instance.id
assert (
result[0].resource_arn
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:instance/{instance.id}"
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION_EU_WEST_1}:{current_audit_info.audited_account}:instance/{instance.id}"
)
@mock_ec2
def test_instance_with_enhanced_monitoring_enabled(self):
ec2 = resource("ec2", region_name=AWS_REGION)
ec2 = resource("ec2", region_name=AWS_REGION_EU_WEST_1)
instance = ec2.create_instances(
ImageId=EXAMPLE_AMI_ID,
MinCount=1,
@@ -113,7 +111,7 @@ class Test_ec2_instance_detailed_monitoring_enabled:
assert len(result) == 1
assert result[0].status == "PASS"
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
# Moto fills instance tags with None
assert result[0].resource_tags is None
assert (
@@ -123,5 +121,5 @@ class Test_ec2_instance_detailed_monitoring_enabled:
assert result[0].resource_id == instance.id
assert (
result[0].resource_arn
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:instance/{instance.id}"
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION_EU_WEST_1}:{current_audit_info.audited_account}:instance/{instance.id}"
)
@@ -9,9 +9,7 @@ from tests.providers.aws.audit_info_utils import (
set_mocked_aws_audit_info,
)
AWS_REGION = "us-east-1"
EXAMPLE_AMI_ID = "ami-12c6146b"
AWS_ACCOUNT_NUMBER = "123456789012"
class Test_ec2_instance_imdsv2_enabled:
@@ -40,7 +38,7 @@ class Test_ec2_instance_imdsv2_enabled:
@mock_ec2
def test_one_compliant_ec2(self):
ec2 = resource("ec2", region_name=AWS_REGION)
ec2 = resource("ec2", region_name=AWS_REGION_EU_WEST_1)
instance = ec2.create_instances(
ImageId=EXAMPLE_AMI_ID,
MinCount=1,
@@ -74,7 +72,7 @@ class Test_ec2_instance_imdsv2_enabled:
assert len(result) == 1
assert result[0].status == "PASS"
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
# Moto fills instance tags with None
assert result[0].resource_tags is None
assert search(
@@ -84,12 +82,12 @@ class Test_ec2_instance_imdsv2_enabled:
assert result[0].resource_id == instance.id
assert (
result[0].resource_arn
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:instance/{instance.id}"
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION_EU_WEST_1}:{current_audit_info.audited_account}:instance/{instance.id}"
)
@mock_ec2
def test_one_uncompliant_ec2_metadata_server_disabled(self):
ec2 = resource("ec2", region_name=AWS_REGION)
ec2 = resource("ec2", region_name=AWS_REGION_EU_WEST_1)
instance = ec2.create_instances(
ImageId=EXAMPLE_AMI_ID,
MinCount=1,
@@ -123,7 +121,7 @@ class Test_ec2_instance_imdsv2_enabled:
assert len(result) == 1
assert result[0].status == "PASS"
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
# Moto fills instance tags with None
assert result[0].resource_tags is None
assert (
@@ -133,12 +131,12 @@ class Test_ec2_instance_imdsv2_enabled:
assert result[0].resource_id == instance.id
assert (
result[0].resource_arn
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:instance/{instance.id}"
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION_EU_WEST_1}:{current_audit_info.audited_account}:instance/{instance.id}"
)
@mock_ec2
def test_one_uncompliant_ec2_metadata_server_enabled(self):
ec2 = resource("ec2", region_name=AWS_REGION)
ec2 = resource("ec2", region_name=AWS_REGION_EU_WEST_1)
instance = ec2.create_instances(
ImageId=EXAMPLE_AMI_ID,
MinCount=1,
@@ -172,7 +170,7 @@ class Test_ec2_instance_imdsv2_enabled:
assert len(result) == 1
assert result[0].status == "FAIL"
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
# Moto fills instance tags with None
assert result[0].resource_tags is None
assert (
@@ -182,5 +180,5 @@ class Test_ec2_instance_imdsv2_enabled:
assert result[0].resource_id == instance.id
assert (
result[0].resource_arn
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:instance/{instance.id}"
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION_EU_WEST_1}:{current_audit_info.audited_account}:instance/{instance.id}"
)
@@ -9,9 +9,7 @@ from tests.providers.aws.audit_info_utils import (
set_mocked_aws_audit_info,
)
AWS_REGION = "us-east-1"
EXAMPLE_AMI_ID = "ami-12c6146b"
AWS_ACCOUNT_NUMBER = "123456789012"
class Test_ec2_instance_internet_facing_with_instance_profile:
@@ -46,7 +44,7 @@ class Test_ec2_instance_internet_facing_with_instance_profile:
_ = iam.create_instance_profile(
InstanceProfileName=profile_name,
)
ec2 = resource("ec2", region_name=AWS_REGION)
ec2 = resource("ec2", region_name=AWS_REGION_EU_WEST_1)
vpc = ec2.create_vpc(CidrBlock="10.0.0.0/16")
subnet = ec2.create_subnet(VpcId=vpc.id, CidrBlock="10.0.0.0/18")
instance = ec2.create_instances(
@@ -83,7 +81,7 @@ class Test_ec2_instance_internet_facing_with_instance_profile:
assert len(result) == 1
assert result[0].status == "PASS"
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].resource_tags is None
assert result[0].status_extended == (
f"EC2 Instance {instance.id} is not internet facing with an instance profile."
@@ -91,7 +89,7 @@ class Test_ec2_instance_internet_facing_with_instance_profile:
assert result[0].resource_id == instance.id
assert (
result[0].resource_arn
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:instance/{instance.id}"
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION_EU_WEST_1}:{current_audit_info.audited_account}:instance/{instance.id}"
)
@mock_iam
@@ -102,7 +100,7 @@ class Test_ec2_instance_internet_facing_with_instance_profile:
_ = iam.create_instance_profile(
InstanceProfileName=profile_name,
)
ec2 = resource("ec2", region_name=AWS_REGION)
ec2 = resource("ec2", region_name=AWS_REGION_EU_WEST_1)
vpc = ec2.create_vpc(CidrBlock="10.0.0.0/16")
subnet = ec2.create_subnet(VpcId=vpc.id, CidrBlock="10.0.0.0/18")
instance = ec2.create_instances(
@@ -139,7 +137,7 @@ class Test_ec2_instance_internet_facing_with_instance_profile:
assert len(result) == 1
assert result[0].status == "FAIL"
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].resource_tags is None
assert search(
"is internet-facing with Instance Profile", result[0].status_extended
@@ -147,5 +145,5 @@ class Test_ec2_instance_internet_facing_with_instance_profile:
assert result[0].resource_id == instance.id
assert (
result[0].resource_arn
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:instance/{instance.id}"
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION_EU_WEST_1}:{current_audit_info.audited_account}:instance/{instance.id}"
)
@@ -5,13 +5,12 @@ from moto import mock_ec2
from prowler.providers.aws.services.ssm.ssm_service import ManagedInstance
from tests.providers.aws.audit_info_utils import (
AWS_ACCOUNT_NUMBER,
AWS_REGION_EU_WEST_1,
set_mocked_aws_audit_info,
)
AWS_REGION = "us-east-1"
EXAMPLE_AMI_ID = "ami-12c6146b"
AWS_ACCOUNT_NUMBER = "123456789012"
class Test_ec2_instance_managed_by_ssm_test:
@@ -52,7 +51,7 @@ class Test_ec2_instance_managed_by_ssm_test:
ssm_client = mock.MagicMock
ssm_client.managed_instances = {}
ec2 = resource("ec2", region_name=AWS_REGION)
ec2 = resource("ec2", region_name=AWS_REGION_EU_WEST_1)
instance = ec2.create_instances(
ImageId=EXAMPLE_AMI_ID,
MinCount=1,
@@ -90,7 +89,7 @@ class Test_ec2_instance_managed_by_ssm_test:
assert len(result) == 1
assert result[0].status == "FAIL"
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].resource_tags is None
assert (
result[0].status_extended
@@ -100,7 +99,7 @@ class Test_ec2_instance_managed_by_ssm_test:
@mock_ec2
def test_ec2_instance_managed_by_ssm_compliance_instance(self):
ec2 = resource("ec2", region_name=AWS_REGION)
ec2 = resource("ec2", region_name=AWS_REGION_EU_WEST_1)
instance = ec2.create_instances(
ImageId=EXAMPLE_AMI_ID,
MinCount=1,
@@ -111,9 +110,9 @@ class Test_ec2_instance_managed_by_ssm_test:
ssm_client = mock.MagicMock
ssm_client.managed_instances = {
instance.id: ManagedInstance(
arn=f"arn:aws:ec2:{AWS_REGION}:{AWS_ACCOUNT_NUMBER}:instance/{instance.id}",
arn=f"arn:aws:ec2:{AWS_REGION_EU_WEST_1}:{AWS_ACCOUNT_NUMBER}:instance/{instance.id}",
id=instance.id,
region=AWS_REGION,
region=AWS_REGION_EU_WEST_1,
)
}
@@ -144,7 +143,7 @@ class Test_ec2_instance_managed_by_ssm_test:
assert len(result) == 1
assert result[0].status == "PASS"
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].resource_tags is None
assert (
result[0].status_extended
@@ -11,9 +11,7 @@ from tests.providers.aws.audit_info_utils import (
set_mocked_aws_audit_info,
)
AWS_REGION = "us-east-1"
EXAMPLE_AMI_ID = "ami-12c6146b"
AWS_ACCOUNT_NUMBER = "123456789012"
class Test_ec2_instance_older_than_specific_days:
@@ -43,7 +41,7 @@ class Test_ec2_instance_older_than_specific_days:
@mock_ec2
def test_one_compliant_ec2(self):
ec2 = resource("ec2", region_name=AWS_REGION)
ec2 = resource("ec2", region_name=AWS_REGION_EU_WEST_1)
instance = ec2.create_instances(
ImageId=EXAMPLE_AMI_ID,
MinCount=1,
@@ -72,7 +70,7 @@ class Test_ec2_instance_older_than_specific_days:
assert len(result) == 1
assert result[0].status == "PASS"
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].resource_tags is None
assert search(
f"EC2 Instance {instance.id} is not older", result[0].status_extended
@@ -80,12 +78,12 @@ class Test_ec2_instance_older_than_specific_days:
assert result[0].resource_id == instance.id
assert (
result[0].resource_arn
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:instance/{instance.id}"
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION_EU_WEST_1}:{current_audit_info.audited_account}:instance/{instance.id}"
)
@mock_ec2
def test_one_old_ec2(self):
ec2 = resource("ec2", region_name=AWS_REGION)
ec2 = resource("ec2", region_name=AWS_REGION_EU_WEST_1)
instance = ec2.create_instances(
ImageId=EXAMPLE_AMI_ID,
MinCount=1,
@@ -118,7 +116,7 @@ class Test_ec2_instance_older_than_specific_days:
assert len(result) == 1
assert result[0].status == "FAIL"
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].resource_tags is None
assert search(
f"EC2 Instance {instance.id} is older", result[0].status_extended
@@ -126,5 +124,5 @@ class Test_ec2_instance_older_than_specific_days:
assert result[0].resource_id == instance.id
assert (
result[0].resource_arn
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:instance/{instance.id}"
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION_EU_WEST_1}:{current_audit_info.audited_account}:instance/{instance.id}"
)
@@ -9,9 +9,7 @@ from tests.providers.aws.audit_info_utils import (
set_mocked_aws_audit_info,
)
AWS_REGION = "us-east-1"
EXAMPLE_AMI_ID = "ami-12c6146b"
AWS_ACCOUNT_NUMBER = "123456789012"
class Test_ec2_instance_profile_attached:
@@ -46,7 +44,7 @@ class Test_ec2_instance_profile_attached:
_ = iam.create_instance_profile(
InstanceProfileName=profile_name,
)
ec2 = resource("ec2", region_name=AWS_REGION)
ec2 = resource("ec2", region_name=AWS_REGION_EU_WEST_1)
vpc = ec2.create_vpc(CidrBlock="10.0.0.0/16")
subnet = ec2.create_subnet(VpcId=vpc.id, CidrBlock="10.0.0.0/18")
instance = ec2.create_instances(
@@ -83,7 +81,7 @@ class Test_ec2_instance_profile_attached:
assert len(result) == 1
assert result[0].status == "PASS"
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].resource_tags is None
assert search(
"associated with Instance Profile Role",
@@ -92,12 +90,12 @@ class Test_ec2_instance_profile_attached:
assert result[0].resource_id == instance.id
assert (
result[0].resource_arn
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:instance/{instance.id}"
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION_EU_WEST_1}:{current_audit_info.audited_account}:instance/{instance.id}"
)
@mock_ec2
def test_one_non_compliant_ec2(self):
ec2 = resource("ec2", region_name=AWS_REGION)
ec2 = resource("ec2", region_name=AWS_REGION_EU_WEST_1)
vpc = ec2.create_vpc(CidrBlock="10.0.0.0/16")
subnet = ec2.create_subnet(VpcId=vpc.id, CidrBlock="10.0.0.0/18")
instance = ec2.create_instances(
@@ -133,7 +131,7 @@ class Test_ec2_instance_profile_attached:
assert len(result) == 1
assert result[0].status == "FAIL"
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].resource_tags is None
assert search(
"not associated with an Instance Profile", result[0].status_extended
@@ -141,5 +139,5 @@ class Test_ec2_instance_profile_attached:
assert result[0].resource_id == instance.id
assert (
result[0].resource_arn
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:instance/{instance.id}"
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION_EU_WEST_1}:{current_audit_info.audited_account}:instance/{instance.id}"
)
@@ -9,9 +9,7 @@ from tests.providers.aws.audit_info_utils import (
set_mocked_aws_audit_info,
)
AWS_REGION = "us-east-1"
EXAMPLE_AMI_ID = "ami-12c6146b"
AWS_ACCOUNT_NUMBER = "123456789012"
class Test_ec2_instance_public_ip:
@@ -40,7 +38,7 @@ class Test_ec2_instance_public_ip:
@mock_ec2
def test_one_compliant_ec2(self):
ec2 = resource("ec2", region_name=AWS_REGION)
ec2 = resource("ec2", region_name=AWS_REGION_EU_WEST_1)
vpc = ec2.create_vpc(CidrBlock="10.0.0.0/16")
subnet = ec2.create_subnet(VpcId=vpc.id, CidrBlock="10.0.0.0/18")
instance = ec2.create_instances(
@@ -76,7 +74,7 @@ class Test_ec2_instance_public_ip:
assert len(result) == 1
assert result[0].status == "PASS"
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].resource_tags is None
assert search(
f"EC2 Instance {instance.id} does not have a Public IP.",
@@ -85,12 +83,12 @@ class Test_ec2_instance_public_ip:
assert result[0].resource_id == instance.id
assert (
result[0].resource_arn
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:instance/{instance.id}"
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION_EU_WEST_1}:{current_audit_info.audited_account}:instance/{instance.id}"
)
@mock_ec2
def test_one_ec2_with_public_ip(self):
ec2 = resource("ec2", region_name=AWS_REGION)
ec2 = resource("ec2", region_name=AWS_REGION_EU_WEST_1)
vpc = ec2.create_vpc(CidrBlock="10.0.0.0/16")
subnet = ec2.create_subnet(VpcId=vpc.id, CidrBlock="10.0.0.0/18")
instance = ec2.create_instances(
@@ -126,7 +124,7 @@ class Test_ec2_instance_public_ip:
assert len(result) == 1
assert result[0].status == "FAIL"
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
assert result[0].resource_tags is None
assert search(
f"EC2 Instance {instance.id} has a Public IP.",
@@ -135,5 +133,5 @@ class Test_ec2_instance_public_ip:
assert result[0].resource_id == instance.id
assert (
result[0].resource_arn
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:instance/{instance.id}"
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION_EU_WEST_1}:{current_audit_info.audited_account}:instance/{instance.id}"
)
@@ -10,9 +10,8 @@ from tests.providers.aws.audit_info_utils import (
set_mocked_aws_audit_info,
)
AWS_REGION = "us-east-1"
EXAMPLE_AMI_ID = "ami-12c6146b"
AWS_ACCOUNT_NUMBER = "123456789012"
ACTUAL_DIRECTORY = Path(path.dirname(path.realpath(__file__)))
FIXTURES_DIR_NAME = "fixtures"
@@ -44,7 +43,7 @@ class Test_ec2_instance_secrets_user_data:
@mock_ec2
def test_one_ec2_with_no_secrets(self):
ec2 = resource("ec2", region_name=AWS_REGION)
ec2 = resource("ec2", region_name=AWS_REGION_EU_WEST_1)
instance = ec2.create_instances(
ImageId=EXAMPLE_AMI_ID,
MinCount=1,
@@ -79,14 +78,14 @@ class Test_ec2_instance_secrets_user_data:
assert result[0].resource_id == instance.id
assert (
result[0].resource_arn
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:instance/{instance.id}"
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION_EU_WEST_1}:{current_audit_info.audited_account}:instance/{instance.id}"
)
assert result[0].resource_tags is None
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
@mock_ec2
def test_one_ec2_with_secrets(self):
ec2 = resource("ec2", region_name=AWS_REGION)
ec2 = resource("ec2", region_name=AWS_REGION_EU_WEST_1)
instance = ec2.create_instances(
ImageId=EXAMPLE_AMI_ID,
MinCount=1,
@@ -121,10 +120,10 @@ class Test_ec2_instance_secrets_user_data:
assert result[0].resource_id == instance.id
assert (
result[0].resource_arn
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:instance/{instance.id}"
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION_EU_WEST_1}:{current_audit_info.audited_account}:instance/{instance.id}"
)
assert result[0].resource_tags is None
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
@mock_ec2
def test_one_ec2_file_with_secrets(self):
@@ -134,7 +133,7 @@ class Test_ec2_instance_secrets_user_data:
"r",
)
secrets = f.read()
ec2 = resource("ec2", region_name=AWS_REGION)
ec2 = resource("ec2", region_name=AWS_REGION_EU_WEST_1)
instance = ec2.create_instances(
ImageId=EXAMPLE_AMI_ID, MinCount=1, MaxCount=1, UserData=secrets
)[0]
@@ -166,14 +165,14 @@ class Test_ec2_instance_secrets_user_data:
assert result[0].resource_id == instance.id
assert (
result[0].resource_arn
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:instance/{instance.id}"
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION_EU_WEST_1}:{current_audit_info.audited_account}:instance/{instance.id}"
)
assert result[0].resource_tags is None
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
@mock_ec2
def test_one_launch_configurations_without_user_data(self):
ec2 = resource("ec2", region_name=AWS_REGION)
ec2 = resource("ec2", region_name=AWS_REGION_EU_WEST_1)
instance = ec2.create_instances(
ImageId=EXAMPLE_AMI_ID, MinCount=1, MaxCount=1, UserData=""
)[0]
@@ -205,10 +204,10 @@ class Test_ec2_instance_secrets_user_data:
assert result[0].resource_id == instance.id
assert (
result[0].resource_arn
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:instance/{instance.id}"
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION_EU_WEST_1}:{current_audit_info.audited_account}:instance/{instance.id}"
)
assert result[0].resource_tags is None
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
@mock_ec2
def test_one_ec2_file_with_secrets_gzip(self):
@@ -218,7 +217,7 @@ class Test_ec2_instance_secrets_user_data:
"rb",
)
secrets = f.read()
ec2 = resource("ec2", region_name=AWS_REGION)
ec2 = resource("ec2", region_name=AWS_REGION_EU_WEST_1)
instance = ec2.create_instances(
ImageId=EXAMPLE_AMI_ID, MinCount=1, MaxCount=1, UserData=secrets
)[0]
@@ -250,7 +249,7 @@ class Test_ec2_instance_secrets_user_data:
assert result[0].resource_id == instance.id
assert (
result[0].resource_arn
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:instance/{instance.id}"
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION_EU_WEST_1}:{current_audit_info.audited_account}:instance/{instance.id}"
)
assert result[0].resource_tags is None
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
@@ -8,9 +8,6 @@ from tests.providers.aws.audit_info_utils import (
set_mocked_aws_audit_info,
)
AWS_REGION = "us-east-1"
AWS_ACCOUNT_NUMBER = "123456789012"
class Test_ec2_networkacl_allow_ingress_any_port:
@mock_ec2
@@ -63,7 +60,7 @@ class Test_ec2_networkacl_allow_ingress_any_port:
# by default nacls are public
assert result[0].status == "FAIL"
assert result[0].region in (AWS_REGION, "eu-west-1")
assert result[0].region in (AWS_REGION_EU_WEST_1, "eu-west-1")
assert result[0].resource_tags == []
assert (
result[0].status_extended
@@ -73,7 +70,7 @@ class Test_ec2_networkacl_allow_ingress_any_port:
@mock_ec2
def test_ec2_non_compliant_nacl(self):
# Create EC2 Mocked Resources
ec2_client = client("ec2", region_name=AWS_REGION)
ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1)
vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"]
nacl_id = ec2_client.create_network_acl(VpcId=vpc_id)["NetworkAcl"][
"NetworkAclId"
@@ -112,7 +109,7 @@ class Test_ec2_networkacl_allow_ingress_any_port:
for nacl in result:
if nacl.resource_id == nacl_id:
assert nacl.status == "FAIL"
assert result[0].region in (AWS_REGION, "eu-west-1")
assert result[0].region in (AWS_REGION_EU_WEST_1, "eu-west-1")
assert result[0].resource_tags == []
assert (
nacl.status_extended
@@ -120,13 +117,13 @@ class Test_ec2_networkacl_allow_ingress_any_port:
)
assert (
nacl.resource_arn
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:network-acl/{nacl_id}"
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION_EU_WEST_1}:{current_audit_info.audited_account}:network-acl/{nacl_id}"
)
@mock_ec2
def test_ec2_compliant_nacl(self):
# Create EC2 Mocked Resources
ec2_client = client("ec2", region_name=AWS_REGION)
ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1)
vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"]
nacl_id = ec2_client.create_network_acl(VpcId=vpc_id)["NetworkAcl"][
"NetworkAclId"
@@ -165,7 +162,7 @@ class Test_ec2_networkacl_allow_ingress_any_port:
for nacl in result:
if nacl.resource_id == nacl_id:
assert nacl.status == "PASS"
assert result[0].region in (AWS_REGION, "eu-west-1")
assert result[0].region in (AWS_REGION_EU_WEST_1, "eu-west-1")
assert result[0].resource_tags == []
assert (
nacl.status_extended
@@ -173,13 +170,13 @@ class Test_ec2_networkacl_allow_ingress_any_port:
)
assert (
nacl.resource_arn
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:network-acl/{nacl_id}"
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION_EU_WEST_1}:{current_audit_info.audited_account}:network-acl/{nacl_id}"
)
@mock_ec2
def test_ec2_non_compliant_nacl_ignoring(self):
# Create EC2 Mocked Resources
ec2_client = client("ec2", region_name=AWS_REGION)
ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1)
vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"]
nacl_id = ec2_client.create_network_acl(VpcId=vpc_id)["NetworkAcl"][
"NetworkAclId"
@@ -218,7 +215,7 @@ class Test_ec2_networkacl_allow_ingress_any_port:
@mock_ec2
def test_ec2_non_compliant_nacl_ignoring_with_sgs(self):
# Create EC2 Mocked Resources
ec2_client = client("ec2", region_name=AWS_REGION)
ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1)
vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"]
nacl_id = ec2_client.create_network_acl(VpcId=vpc_id)["NetworkAcl"][
"NetworkAclId"
@@ -259,7 +256,7 @@ class Test_ec2_networkacl_allow_ingress_any_port:
for nacl in result:
if nacl.resource_id == nacl_id:
assert nacl.status == "FAIL"
assert result[0].region in (AWS_REGION, "eu-west-1")
assert result[0].region in (AWS_REGION_EU_WEST_1, "eu-west-1")
assert result[0].resource_tags == []
assert (
nacl.status_extended
@@ -267,5 +264,5 @@ class Test_ec2_networkacl_allow_ingress_any_port:
)
assert (
nacl.resource_arn
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:network-acl/{nacl_id}"
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION_EU_WEST_1}:{current_audit_info.audited_account}:network-acl/{nacl_id}"
)
@@ -8,9 +8,6 @@ from tests.providers.aws.audit_info_utils import (
set_mocked_aws_audit_info,
)
AWS_REGION = "us-east-1"
AWS_ACCOUNT_NUMBER = "123456789012"
class Test_ec2_networkacl_allow_ingress_tcp_port_22:
@mock_ec2
@@ -63,7 +60,7 @@ class Test_ec2_networkacl_allow_ingress_tcp_port_22:
# by default nacls are public
assert result[0].status == "FAIL"
assert result[0].region in (AWS_REGION, "eu-west-1")
assert result[0].region in (AWS_REGION_EU_WEST_1, "eu-west-1")
assert result[0].resource_tags == []
assert (
result[0].status_extended
@@ -73,7 +70,7 @@ class Test_ec2_networkacl_allow_ingress_tcp_port_22:
@mock_ec2
def test_ec2_non_compliant_nacl(self):
# Create EC2 Mocked Resources
ec2_client = client("ec2", region_name=AWS_REGION)
ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1)
vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"]
nacl_id = ec2_client.create_network_acl(VpcId=vpc_id)["NetworkAcl"][
"NetworkAclId"
@@ -113,7 +110,7 @@ class Test_ec2_networkacl_allow_ingress_tcp_port_22:
for nacl in result:
if nacl.resource_id == nacl_id:
assert nacl.status == "FAIL"
assert result[0].region in (AWS_REGION, "eu-west-1")
assert result[0].region in (AWS_REGION_EU_WEST_1, "eu-west-1")
assert result[0].resource_tags == []
assert (
nacl.status_extended
@@ -121,13 +118,13 @@ class Test_ec2_networkacl_allow_ingress_tcp_port_22:
)
assert (
nacl.resource_arn
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:network-acl/{nacl_id}"
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION_EU_WEST_1}:{current_audit_info.audited_account}:network-acl/{nacl_id}"
)
@mock_ec2
def test_ec2_compliant_nacl(self):
# Create EC2 Mocked Resources
ec2_client = client("ec2", region_name=AWS_REGION)
ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1)
vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"]
nacl_id = ec2_client.create_network_acl(VpcId=vpc_id)["NetworkAcl"][
"NetworkAclId"
@@ -167,7 +164,7 @@ class Test_ec2_networkacl_allow_ingress_tcp_port_22:
for nacl in result:
if nacl.resource_id == nacl_id:
assert nacl.status == "PASS"
assert result[0].region in (AWS_REGION, "eu-west-1")
assert result[0].region in (AWS_REGION_EU_WEST_1, "eu-west-1")
assert result[0].resource_tags == []
assert (
nacl.status_extended
@@ -175,13 +172,13 @@ class Test_ec2_networkacl_allow_ingress_tcp_port_22:
)
assert (
nacl.resource_arn
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:network-acl/{nacl_id}"
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION_EU_WEST_1}:{current_audit_info.audited_account}:network-acl/{nacl_id}"
)
@mock_ec2
def test_ec2_non_compliant_nacl_ignoring(self):
# Create EC2 Mocked Resources
ec2_client = client("ec2", region_name=AWS_REGION)
ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1)
vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"]
nacl_id = ec2_client.create_network_acl(VpcId=vpc_id)["NetworkAcl"][
"NetworkAclId"
@@ -220,7 +217,7 @@ class Test_ec2_networkacl_allow_ingress_tcp_port_22:
@mock_ec2
def test_ec2_non_compliant_nacl_ignoring_with_sgs(self):
# Create EC2 Mocked Resources
ec2_client = client("ec2", region_name=AWS_REGION)
ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1)
vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"]
nacl_id = ec2_client.create_network_acl(VpcId=vpc_id)["NetworkAcl"][
"NetworkAclId"
@@ -261,7 +258,7 @@ class Test_ec2_networkacl_allow_ingress_tcp_port_22:
for nacl in result:
if nacl.resource_id == nacl_id:
assert nacl.status == "FAIL"
assert result[0].region in (AWS_REGION, "eu-west-1")
assert result[0].region in (AWS_REGION_EU_WEST_1, "eu-west-1")
assert result[0].resource_tags == []
assert (
nacl.status_extended
@@ -269,5 +266,5 @@ class Test_ec2_networkacl_allow_ingress_tcp_port_22:
)
assert (
nacl.resource_arn
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:network-acl/{nacl_id}"
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION_EU_WEST_1}:{current_audit_info.audited_account}:network-acl/{nacl_id}"
)
@@ -8,9 +8,6 @@ from tests.providers.aws.audit_info_utils import (
set_mocked_aws_audit_info,
)
AWS_REGION = "us-east-1"
AWS_ACCOUNT_NUMBER = "123456789012"
class Test_ec2_networkacl_allow_ingress_tcp_port_3389:
@mock_ec2
@@ -63,7 +60,7 @@ class Test_ec2_networkacl_allow_ingress_tcp_port_3389:
# by default nacls are public
assert result[0].status == "FAIL"
assert result[0].region in (AWS_REGION, "eu-west-1")
assert result[0].region in (AWS_REGION_EU_WEST_1, "eu-west-1")
assert result[0].resource_tags == []
assert (
result[0].status_extended
@@ -73,7 +70,7 @@ class Test_ec2_networkacl_allow_ingress_tcp_port_3389:
@mock_ec2
def test_ec2_non_compliant_nacl(self):
# Create EC2 Mocked Resources
ec2_client = client("ec2", region_name=AWS_REGION)
ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1)
vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"]
nacl_id = ec2_client.create_network_acl(VpcId=vpc_id)["NetworkAcl"][
"NetworkAclId"
@@ -113,7 +110,7 @@ class Test_ec2_networkacl_allow_ingress_tcp_port_3389:
for nacl in result:
if nacl.resource_id == nacl_id:
assert nacl.status == "FAIL"
assert result[0].region in (AWS_REGION, "eu-west-1")
assert result[0].region in (AWS_REGION_EU_WEST_1, "eu-west-1")
assert result[0].resource_tags == []
assert (
nacl.status_extended
@@ -121,13 +118,13 @@ class Test_ec2_networkacl_allow_ingress_tcp_port_3389:
)
assert (
nacl.resource_arn
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:network-acl/{nacl_id}"
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION_EU_WEST_1}:{current_audit_info.audited_account}:network-acl/{nacl_id}"
)
@mock_ec2
def test_ec2_compliant_nacl(self):
# Create EC2 Mocked Resources
ec2_client = client("ec2", region_name=AWS_REGION)
ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1)
vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"]
nacl_id = ec2_client.create_network_acl(VpcId=vpc_id)["NetworkAcl"][
"NetworkAclId"
@@ -167,7 +164,7 @@ class Test_ec2_networkacl_allow_ingress_tcp_port_3389:
for nacl in result:
if nacl.resource_id == nacl_id:
assert nacl.status == "PASS"
assert result[0].region in (AWS_REGION, "eu-west-1")
assert result[0].region in (AWS_REGION_EU_WEST_1, "eu-west-1")
assert result[0].resource_tags == []
assert (
nacl.status_extended
@@ -175,13 +172,13 @@ class Test_ec2_networkacl_allow_ingress_tcp_port_3389:
)
assert (
nacl.resource_arn
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:network-acl/{nacl_id}"
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION_EU_WEST_1}:{current_audit_info.audited_account}:network-acl/{nacl_id}"
)
@mock_ec2
def test_ec2_non_compliant_nacl_ignoring(self):
# Create EC2 Mocked Resources
ec2_client = client("ec2", region_name=AWS_REGION)
ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1)
vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"]
nacl_id = ec2_client.create_network_acl(VpcId=vpc_id)["NetworkAcl"][
"NetworkAclId"
@@ -220,7 +217,7 @@ class Test_ec2_networkacl_allow_ingress_tcp_port_3389:
@mock_ec2
def test_ec2_non_compliant_nacl_ignoring_with_sgs(self):
# Create EC2 Mocked Resources
ec2_client = client("ec2", region_name=AWS_REGION)
ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1)
vpc_id = ec2_client.create_vpc(CidrBlock="10.0.0.0/16")["Vpc"]["VpcId"]
nacl_id = ec2_client.create_network_acl(VpcId=vpc_id)["NetworkAcl"][
"NetworkAclId"
@@ -261,7 +258,7 @@ class Test_ec2_networkacl_allow_ingress_tcp_port_3389:
for nacl in result:
if nacl.resource_id == nacl_id:
assert nacl.status == "FAIL"
assert result[0].region in (AWS_REGION, "eu-west-1")
assert result[0].region in (AWS_REGION_EU_WEST_1, "eu-west-1")
assert result[0].resource_tags == []
assert (
nacl.status_extended
@@ -269,5 +266,5 @@ class Test_ec2_networkacl_allow_ingress_tcp_port_3389:
)
assert (
nacl.resource_arn
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:network-acl/{nacl_id}"
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION_EU_WEST_1}:{current_audit_info.audited_account}:network-acl/{nacl_id}"
)
@@ -1,63 +1,30 @@
from unittest import mock
from boto3 import client, resource, session
from boto3 import client, resource
from moto import mock_ec2
from prowler.providers.aws.lib.audit_info.models import AWS_Audit_Info
from prowler.providers.aws.services.vpc.vpc_service import VPC
from prowler.providers.common.models import Audit_Metadata
from tests.providers.aws.audit_info_utils import (
AWS_REGION_EU_WEST_1,
set_mocked_aws_audit_info,
)
AWS_REGION = "us-east-1"
AWS_ACCOUNT_NUMBER = "123456789012"
class Test_ec2_securitygroup_allow_ingress_from_internet_to_any_port:
def set_mocked_audit_info(self):
audit_info = AWS_Audit_Info(
session_config=None,
original_session=None,
audit_session=session.Session(
profile_name=None,
botocore_session=None,
),
audited_account=AWS_ACCOUNT_NUMBER,
audited_account_arn=f"arn:aws:iam::{AWS_ACCOUNT_NUMBER}:root",
audited_user_id=None,
audited_partition="aws",
audited_identity_arn=None,
profile=None,
profile_region=None,
credentials=None,
assumed_role_info=None,
audited_regions=["us-east-1", "eu-west-1"],
organizations_metadata=None,
audit_resources=None,
mfa_enabled=False,
audit_metadata=Audit_Metadata(
services_scanned=0,
expected_checks=[
"ec2_securitygroup_allow_ingress_from_internet_to_any_port"
],
completed_checks=0,
audit_progress=0,
),
)
return audit_info
@mock_ec2
def test_ec2_default_sgs(self):
# Create EC2 Mocked Resources
ec2_client = client("ec2", region_name=AWS_REGION)
ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1)
ec2_client.create_vpc(CidrBlock="10.0.0.0/16")
from prowler.providers.aws.services.ec2.ec2_service import EC2
current_audit_info = set_mocked_aws_audit_info([AWS_REGION_EU_WEST_1])
current_audit_info = set_mocked_aws_audit_info(
[AWS_REGION_EU_WEST_1],
expected_checks=[
"ec2_securitygroup_allow_ingress_from_internet_to_any_port"
],
)
with mock.patch(
"prowler.providers.aws.lib.audit_info.audit_info.current_audit_info",
@@ -87,7 +54,7 @@ class Test_ec2_securitygroup_allow_ingress_from_internet_to_any_port:
@mock_ec2
def test_ec2_non_compliant_default_sg(self):
# Create EC2 Mocked Resources
ec2_client = client("ec2", region_name=AWS_REGION)
ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1)
ec2_client.create_vpc(CidrBlock="10.0.0.0/16")
default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[
"SecurityGroups"
@@ -106,7 +73,12 @@ class Test_ec2_securitygroup_allow_ingress_from_internet_to_any_port:
from prowler.providers.aws.services.ec2.ec2_service import EC2
current_audit_info = set_mocked_aws_audit_info([AWS_REGION_EU_WEST_1])
current_audit_info = set_mocked_aws_audit_info(
[AWS_REGION_EU_WEST_1],
expected_checks=[
"ec2_securitygroup_allow_ingress_from_internet_to_any_port"
],
)
with mock.patch(
"prowler.providers.aws.lib.audit_info.audit_info.current_audit_info",
@@ -132,14 +104,14 @@ class Test_ec2_securitygroup_allow_ingress_from_internet_to_any_port:
for sg in result:
if sg.resource_id == default_sg_id:
assert sg.status == "FAIL"
assert sg.region == AWS_REGION
assert sg.region == AWS_REGION_EU_WEST_1
assert (
sg.status_extended
== f"Security group {default_sg_name} ({default_sg_id}) has all ports open to the Internet."
)
assert (
sg.resource_arn
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:security-group/{default_sg_id}"
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION_EU_WEST_1}:{current_audit_info.audited_account}:security-group/{default_sg_id}"
)
assert sg.resource_details == default_sg_name
assert sg.resource_tags == []
@@ -147,7 +119,7 @@ class Test_ec2_securitygroup_allow_ingress_from_internet_to_any_port:
@mock_ec2
def test_ec2_compliant_default_sg(self):
# Create EC2 Mocked Resources
ec2_client = client("ec2", region_name=AWS_REGION)
ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1)
ec2_client.create_vpc(CidrBlock="10.0.0.0/16")
default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[
"SecurityGroups"
@@ -166,7 +138,12 @@ class Test_ec2_securitygroup_allow_ingress_from_internet_to_any_port:
from prowler.providers.aws.services.ec2.ec2_service import EC2
current_audit_info = set_mocked_aws_audit_info([AWS_REGION_EU_WEST_1])
current_audit_info = set_mocked_aws_audit_info(
[AWS_REGION_EU_WEST_1],
expected_checks=[
"ec2_securitygroup_allow_ingress_from_internet_to_any_port"
],
)
with mock.patch(
"prowler.providers.aws.lib.audit_info.audit_info.current_audit_info",
@@ -192,14 +169,14 @@ class Test_ec2_securitygroup_allow_ingress_from_internet_to_any_port:
for sg in result:
if sg.resource_id == default_sg_id:
assert sg.status == "PASS"
assert sg.region == AWS_REGION
assert sg.region == AWS_REGION_EU_WEST_1
assert (
sg.status_extended
== f"Security group {default_sg_name} ({default_sg_id}) does not have all ports open to the Internet."
)
assert (
sg.resource_arn
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:security-group/{default_sg_id}"
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION_EU_WEST_1}:{current_audit_info.audited_account}:security-group/{default_sg_id}"
)
assert sg.resource_details == default_sg_name
assert sg.resource_tags == []
@@ -207,7 +184,7 @@ class Test_ec2_securitygroup_allow_ingress_from_internet_to_any_port:
@mock_ec2
def test_ec2_compliant_default_sg_only_open_to_one_port(self):
# Create EC2 Mocked Resources
ec2_client = client("ec2", region_name=AWS_REGION)
ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1)
ec2_client.create_vpc(CidrBlock="10.0.0.0/16")
default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[
"SecurityGroups"
@@ -231,7 +208,12 @@ class Test_ec2_securitygroup_allow_ingress_from_internet_to_any_port:
from prowler.providers.aws.services.ec2.ec2_service import EC2
current_audit_info = set_mocked_aws_audit_info([AWS_REGION_EU_WEST_1])
current_audit_info = set_mocked_aws_audit_info(
[AWS_REGION_EU_WEST_1],
expected_checks=[
"ec2_securitygroup_allow_ingress_from_internet_to_any_port"
],
)
with mock.patch(
"prowler.providers.aws.lib.audit_info.audit_info.current_audit_info",
@@ -257,14 +239,14 @@ class Test_ec2_securitygroup_allow_ingress_from_internet_to_any_port:
for sg in result:
if sg.resource_id == default_sg_id:
assert sg.status == "PASS"
assert sg.region == AWS_REGION
assert sg.region == AWS_REGION_EU_WEST_1
assert (
sg.status_extended
== f"Security group {default_sg_name} ({default_sg_id}) does not have all ports open to the Internet."
)
assert (
sg.resource_arn
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:security-group/{default_sg_id}"
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION_EU_WEST_1}:{current_audit_info.audited_account}:security-group/{default_sg_id}"
)
assert sg.resource_details == default_sg_name
assert sg.resource_tags == []
@@ -272,12 +254,17 @@ class Test_ec2_securitygroup_allow_ingress_from_internet_to_any_port:
@mock_ec2
def test_ec2_default_sgs_ignoring(self):
# Create EC2 Mocked Resources
ec2_client = client("ec2", region_name=AWS_REGION)
ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1)
ec2_client.create_vpc(CidrBlock="10.0.0.0/16")
from prowler.providers.aws.services.ec2.ec2_service import EC2
current_audit_info = set_mocked_aws_audit_info([AWS_REGION_EU_WEST_1])
current_audit_info = set_mocked_aws_audit_info(
[AWS_REGION_EU_WEST_1],
expected_checks=[
"ec2_securitygroup_allow_ingress_from_internet_to_any_port"
],
)
current_audit_info.ignore_unused_services = True
with mock.patch(
@@ -303,11 +290,11 @@ class Test_ec2_securitygroup_allow_ingress_from_internet_to_any_port:
@mock_ec2
def test_ec2_default_sgs_ignoring_vpc_in_use(self):
# Create EC2 Mocked Resources
ec2 = resource("ec2", region_name=AWS_REGION)
ec2 = resource("ec2", region_name=AWS_REGION_EU_WEST_1)
vpc = ec2.create_vpc(CidrBlock="10.0.0.0/16")
subnet = ec2.create_subnet(VpcId=vpc.id, CidrBlock="10.0.0.0/18")
ec2.create_network_interface(SubnetId=subnet.id)
ec2_client = client("ec2", region_name=AWS_REGION)
ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1)
default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[
"SecurityGroups"
][0]
@@ -315,7 +302,12 @@ class Test_ec2_securitygroup_allow_ingress_from_internet_to_any_port:
default_sg["GroupName"]
from prowler.providers.aws.services.ec2.ec2_service import EC2
current_audit_info = set_mocked_aws_audit_info([AWS_REGION_EU_WEST_1])
current_audit_info = set_mocked_aws_audit_info(
[AWS_REGION_EU_WEST_1],
expected_checks=[
"ec2_securitygroup_allow_ingress_from_internet_to_any_port"
],
)
current_audit_info.ignore_unused_services = True
with mock.patch(
@@ -338,4 +330,4 @@ class Test_ec2_securitygroup_allow_ingress_from_internet_to_any_port:
assert len(result) == 1
assert result[0].status == "PASS"
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
@@ -9,15 +9,12 @@ from tests.providers.aws.audit_info_utils import (
set_mocked_aws_audit_info,
)
AWS_REGION = "us-east-1"
AWS_ACCOUNT_NUMBER = "123456789012"
class Test_ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_27018:
@mock_ec2
def test_ec2_default_sgs(self):
# Create EC2 Mocked Resources
ec2_client = client("ec2", region_name=AWS_REGION)
ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1)
ec2_client.create_vpc(CidrBlock="10.0.0.0/16")
from prowler.providers.aws.services.ec2.ec2_service import EC2
@@ -54,7 +51,7 @@ class Test_ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_2
@mock_ec2
def test_ec2_non_compliant_default_sg(self):
# Create EC2 Mocked Resources
ec2_client = client("ec2", region_name=AWS_REGION)
ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1)
ec2_client.create_vpc(CidrBlock="10.0.0.0/16")
default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[
"SecurityGroups"
@@ -103,14 +100,14 @@ class Test_ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_2
for sg in result:
if sg.resource_id == default_sg_id:
assert sg.status == "FAIL"
assert sg.region == AWS_REGION
assert sg.region == AWS_REGION_EU_WEST_1
assert (
sg.status_extended
== f"Security group {default_sg_name} ({default_sg_id}) has MongoDB ports 27017 and 27018 open to the Internet."
)
assert (
sg.resource_arn
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:security-group/{default_sg_id}"
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION_EU_WEST_1}:{current_audit_info.audited_account}:security-group/{default_sg_id}"
)
assert sg.resource_details == default_sg_name
assert sg.resource_tags == []
@@ -118,7 +115,7 @@ class Test_ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_2
@mock_ec2
def test_ec2_compliant_default_sg(self):
# Create EC2 Mocked Resources
ec2_client = client("ec2", region_name=AWS_REGION)
ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1)
ec2_client.create_vpc(CidrBlock="10.0.0.0/16")
default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[
"SecurityGroups"
@@ -167,14 +164,14 @@ class Test_ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_2
for sg in result:
if sg.resource_id == default_sg_id:
assert sg.status == "PASS"
assert sg.region == AWS_REGION
assert sg.region == AWS_REGION_EU_WEST_1
assert (
sg.status_extended
== f"Security group {default_sg_name} ({default_sg_id}) does not have MongoDB ports 27017 and 27018 open to the Internet."
)
assert (
sg.resource_arn
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:security-group/{default_sg_id}"
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION_EU_WEST_1}:{current_audit_info.audited_account}:security-group/{default_sg_id}"
)
assert sg.resource_details == default_sg_name
assert sg.resource_tags == []
@@ -182,7 +179,7 @@ class Test_ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_2
@mock_ec2
def test_ec2_default_sgs_ignoring(self):
# Create EC2 Mocked Resources
ec2_client = client("ec2", region_name=AWS_REGION)
ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1)
ec2_client.create_vpc(CidrBlock="10.0.0.0/16")
from prowler.providers.aws.services.ec2.ec2_service import EC2
@@ -215,11 +212,11 @@ class Test_ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_2
@mock_ec2
def test_ec2_default_sgs_ignoring_vpc_in_use(self):
# Create EC2 Mocked Resources
ec2 = resource("ec2", region_name=AWS_REGION)
ec2 = resource("ec2", region_name=AWS_REGION_EU_WEST_1)
vpc = ec2.create_vpc(CidrBlock="10.0.0.0/16")
subnet = ec2.create_subnet(VpcId=vpc.id, CidrBlock="10.0.0.0/18")
ec2.create_network_interface(SubnetId=subnet.id)
ec2_client = client("ec2", region_name=AWS_REGION)
ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1)
default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[
"SecurityGroups"
][0]
@@ -252,4 +249,4 @@ class Test_ec2_securitygroup_allow_ingress_from_internet_to_port_mongodb_27017_2
assert len(result) == 1
assert result[0].status == "PASS"
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
@@ -9,15 +9,12 @@ from tests.providers.aws.audit_info_utils import (
set_mocked_aws_audit_info,
)
AWS_REGION = "us-east-1"
AWS_ACCOUNT_NUMBER = "123456789012"
class Test_ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21:
@mock_ec2
def test_ec2_default_sgs(self):
# Create EC2 Mocked Resources
ec2_client = client("ec2", region_name=AWS_REGION)
ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1)
ec2_client.create_vpc(CidrBlock="10.0.0.0/16")
from prowler.providers.aws.services.ec2.ec2_service import EC2
@@ -54,7 +51,7 @@ class Test_ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21:
@mock_ec2
def test_ec2_non_compliant_default_sg(self):
# Create EC2 Mocked Resources
ec2_client = client("ec2", region_name=AWS_REGION)
ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1)
ec2_client.create_vpc(CidrBlock="10.0.0.0/16")
default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[
"SecurityGroups"
@@ -103,14 +100,14 @@ class Test_ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21:
for sg in result:
if sg.resource_id == default_sg_id:
assert sg.status == "FAIL"
assert sg.region == AWS_REGION
assert sg.region == AWS_REGION_EU_WEST_1
assert (
sg.status_extended
== f"Security group {default_sg_name} ({default_sg_id}) has FTP ports 20 and 21 open to the Internet."
)
assert (
sg.resource_arn
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:security-group/{default_sg_id}"
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION_EU_WEST_1}:{current_audit_info.audited_account}:security-group/{default_sg_id}"
)
assert sg.resource_details == default_sg_name
assert sg.resource_tags == []
@@ -118,7 +115,7 @@ class Test_ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21:
@mock_ec2
def test_ec2_compliant_default_sg(self):
# Create EC2 Mocked Resources
ec2_client = client("ec2", region_name=AWS_REGION)
ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1)
ec2_client.create_vpc(CidrBlock="10.0.0.0/16")
default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[
"SecurityGroups"
@@ -167,14 +164,14 @@ class Test_ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21:
for sg in result:
if sg.resource_id == default_sg_id:
assert sg.status == "PASS"
assert sg.region == AWS_REGION
assert sg.region == AWS_REGION_EU_WEST_1
assert (
sg.status_extended
== f"Security group {default_sg_name} ({default_sg_id}) does not have FTP ports 20 and 21 open to the Internet."
)
assert (
sg.resource_arn
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:security-group/{default_sg_id}"
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION_EU_WEST_1}:{current_audit_info.audited_account}:security-group/{default_sg_id}"
)
assert sg.resource_details == default_sg_name
assert sg.resource_tags == []
@@ -182,7 +179,7 @@ class Test_ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21:
@mock_ec2
def test_ec2_default_sgs_ignoring(self):
# Create EC2 Mocked Resources
ec2_client = client("ec2", region_name=AWS_REGION)
ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1)
ec2_client.create_vpc(CidrBlock="10.0.0.0/16")
from prowler.providers.aws.services.ec2.ec2_service import EC2
@@ -215,11 +212,11 @@ class Test_ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21:
@mock_ec2
def test_ec2_default_sgs_ignoring_vpc_in_use(self):
# Create EC2 Mocked Resources
ec2 = resource("ec2", region_name=AWS_REGION)
ec2 = resource("ec2", region_name=AWS_REGION_EU_WEST_1)
vpc = ec2.create_vpc(CidrBlock="10.0.0.0/16")
subnet = ec2.create_subnet(VpcId=vpc.id, CidrBlock="10.0.0.0/18")
ec2.create_network_interface(SubnetId=subnet.id)
ec2_client = client("ec2", region_name=AWS_REGION)
ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1)
default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[
"SecurityGroups"
][0]
@@ -252,4 +249,4 @@ class Test_ec2_securitygroup_allow_ingress_from_internet_to_tcp_ftp_port_20_21:
assert len(result) == 1
assert result[0].status == "PASS"
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1
@@ -10,15 +10,12 @@ from tests.providers.aws.audit_info_utils import (
set_mocked_aws_audit_info,
)
AWS_REGION = "us-east-1"
AWS_ACCOUNT_NUMBER = "123456789012"
class Test_ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22:
@mock_ec2
def test_ec2_default_sgs(self):
# Create EC2 Mocked Resources
ec2_client = client("ec2", region_name=AWS_REGION)
ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1)
ec2_client.create_vpc(CidrBlock="10.0.0.0/16")
from prowler.providers.aws.services.ec2.ec2_service import EC2
@@ -53,7 +50,7 @@ class Test_ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22:
@mock_ec2
def test_ec2_non_compliant_default_sg(self):
# Create EC2 Mocked Resources
ec2_client = client("ec2", region_name=AWS_REGION)
ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1)
ec2_client.create_vpc(CidrBlock="10.0.0.0/16")
default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[
"SecurityGroups"
@@ -100,7 +97,7 @@ class Test_ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22:
for sg in result:
if sg.resource_id == default_sg_id:
assert sg.status == "FAIL"
assert sg.region == AWS_REGION
assert sg.region == AWS_REGION_EU_WEST_1
assert (
sg.status_extended
== f"Security group {default_sg_name} ({default_sg_id}) has SSH port 22 open to the Internet."
@@ -111,7 +108,7 @@ class Test_ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22:
)
assert (
sg.resource_arn
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:security-group/{default_sg_id}"
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION_EU_WEST_1}:{current_audit_info.audited_account}:security-group/{default_sg_id}"
)
assert sg.resource_details == default_sg_name
assert sg.resource_tags == []
@@ -119,7 +116,7 @@ class Test_ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22:
@mock_ec2
def test_ec2_compliant_default_sg(self):
# Create EC2 Mocked Resources
ec2_client = client("ec2", region_name=AWS_REGION)
ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1)
ec2_client.create_vpc(CidrBlock="10.0.0.0/16")
default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[
"SecurityGroups"
@@ -166,14 +163,14 @@ class Test_ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22:
for sg in result:
if sg.resource_id == default_sg_id:
assert sg.status == "PASS"
assert sg.region == AWS_REGION
assert sg.region == AWS_REGION_EU_WEST_1
assert (
sg.status_extended
== f"Security group {default_sg_name} ({default_sg_id}) does not have SSH port 22 open to the Internet."
)
assert (
sg.resource_arn
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION}:{current_audit_info.audited_account}:security-group/{default_sg_id}"
== f"arn:{current_audit_info.audited_partition}:ec2:{AWS_REGION_EU_WEST_1}:{current_audit_info.audited_account}:security-group/{default_sg_id}"
)
assert sg.resource_details == default_sg_name
assert sg.resource_tags == []
@@ -181,7 +178,7 @@ class Test_ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22:
@mock_ec2
def test_ec2_default_sgs_ignoring(self):
# Create EC2 Mocked Resources
ec2_client = client("ec2", region_name=AWS_REGION)
ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1)
ec2_client.create_vpc(CidrBlock="10.0.0.0/16")
from prowler.providers.aws.services.ec2.ec2_service import EC2
@@ -212,11 +209,11 @@ class Test_ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22:
@mock_ec2
def test_ec2_default_sgs_ignoring_vpc_in_use(self):
# Create EC2 Mocked Resources
ec2 = resource("ec2", region_name=AWS_REGION)
ec2 = resource("ec2", region_name=AWS_REGION_EU_WEST_1)
vpc = ec2.create_vpc(CidrBlock="10.0.0.0/16")
subnet = ec2.create_subnet(VpcId=vpc.id, CidrBlock="10.0.0.0/18")
ec2.create_network_interface(SubnetId=subnet.id)
ec2_client = client("ec2", region_name=AWS_REGION)
ec2_client = client("ec2", region_name=AWS_REGION_EU_WEST_1)
default_sg = ec2_client.describe_security_groups(GroupNames=["default"])[
"SecurityGroups"
][0]
@@ -247,4 +244,4 @@ class Test_ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22:
assert len(result) == 1
assert result[0].status == "PASS"
assert result[0].region == AWS_REGION
assert result[0].region == AWS_REGION_EU_WEST_1

Some files were not shown because too many files have changed in this diff Show More