ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-07-24 13:01:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

refactor(cloudfront): replace origins dictionary with custom Origin class (#4981)

Browse Source 
Co-authored-by: Sergio <sergio@prowler.com>
This commit is contained in:
Hugo Pereira Brito
2024-09-10 22:04:57 +02:00
committed by GitHub
parent 3406a07ae5
commit 75c48cfaa3
4 changed files with 68 additions and 153 deletions
Download Patch File Download Diff File Expand all files Collapse all files
prowler/providers/aws/services/cloudfront/cloudfront_distributions_using_deprecated_ssl_protocols/cloudfront_distributions_using_deprecated_ssl_protocols.py
+3 -4
View File
@@ -21,10 +21,8 @@ class cloudfront_distributions_using_deprecated_ssl_protocols(Check):
bad_ssl_protocol = False
for origin in distribution.origins:
if "CustomOriginConfig" in origin:
for ssl_protocol in origin["CustomOriginConfig"][
"OriginSslProtocols"
]["Items"]:
if origin.origin_ssl_protocols:
for ssl_protocol in origin.origin_ssl_protocols:
if ssl_protocol in (
OriginsSSLProtocols.SSLv3.value,
OriginsSSLProtocols.TLSv1.value,
@@ -32,6 +30,7 @@ class cloudfront_distributions_using_deprecated_ssl_protocols(Check):
):
bad_ssl_protocol = True
break
if bad_ssl_protocol:
report.status = "FAIL"
report.status_extended = f"CloudFront Distribution {distribution.id} is using a deprecated SSL protocol."
prowler/providers/aws/services/cloudfront/cloudfront_service.py
+24 -2
View File
@@ -30,7 +30,22 @@ class CloudFront(AWSService):
):
distribution_id = item["Id"]
distribution_arn = item["ARN"]
origins = item["Origins"]["Items"]
origins = []
for origin in item.get("Origins", {}).get("Items", []):
origins.append(
Origin(
id=origin["Id"],
domain_name=origin["DomainName"],
origin_protocol_policy=origin.get(
"CustomOriginConfig", {}
).get("OriginProtocolPolicy", ""),
origin_ssl_protocols=origin.get(
"CustomOriginConfig", {}
)
.get("OriginSslProtocols", {})
.get("Items", []),
)
)
distribution = Distribution(
arn=distribution_arn,
id=distribution_id,
@@ -130,6 +145,13 @@ class DefaultCacheConfigBehaviour(BaseModel):
field_level_encryption_id: str
class Origin(BaseModel):
id: str
domain_name: str
origin_protocol_policy: str
origin_ssl_protocols: list[str]
class Distribution(BaseModel):
"""Distribution holds a CloudFront Distribution resource"""
@@ -139,6 +161,6 @@ class Distribution(BaseModel):
logging_enabled: bool = False
default_cache_config: Optional[DefaultCacheConfigBehaviour]
geo_restriction_type: Optional[GeoRestrictionType]
origins: list
origins: list[Origin]
web_acl_id: str = ""
tags: Optional[list] = []
tests/providers/aws/services/cloudfront/cloudfront_distributions_using_deprecated_ssl_protocols/cloudfront_distributions_using_deprecated_ssl_protocols_test.py
+36 -141
View File
@@ -1,6 +1,9 @@
from unittest import mock
from prowler.providers.aws.services.cloudfront.cloudfront_service import Distribution
from prowler.providers.aws.services.cloudfront.cloudfront_service import (
Distribution,
Origin,
)
from tests.providers.aws.utils import AWS_ACCOUNT_NUMBER
DISTRIBUTION_ID = "E27LVI50CSW06W"
@@ -36,41 +39,12 @@ class Test_cloudfront_distributions_using_deprecated_ssl_protocols:
id=DISTRIBUTION_ID,
region=REGION,
origins=[
{
"Id": "string",
"DomainName": "string",
"OriginPath": "string",
"CustomHeaders": {
"Quantity": 123,
"Items": [
{
"HeaderName": "string",
"HeaderValue": "string",
},
],
},
"S3OriginConfig": {"OriginAccessIdentity": "string"},
"CustomOriginConfig": {
"HTTPPort": 123,
"HTTPSPort": 123,
"OriginProtocolPolicy": "https-only",
"OriginSslProtocols": {
"Quantity": 123,
"Items": [
"SSLv3",
],
},
"OriginReadTimeout": 123,
"OriginKeepaliveTimeout": 123,
},
"ConnectionAttempts": 123,
"ConnectionTimeout": 123,
"OriginShield": {
"Enabled": False,
"OriginShieldRegion": "string",
},
"OriginAccessControlId": "string",
},
Origin(
id="string",
domain_name="string",
origin_protocol_policy="https-only",
origin_ssl_protocols=["SSLv3"],
)
],
)
}
@@ -106,42 +80,15 @@ class Test_cloudfront_distributions_using_deprecated_ssl_protocols:
id=DISTRIBUTION_ID,
region=REGION,
origins=[
{
"Id": "string",
"DomainName": "string",
"OriginPath": "string",
"CustomHeaders": {
"Quantity": 123,
"Items": [
{
"HeaderName": "string",
"HeaderValue": "string",
},
],
},
"S3OriginConfig": {"OriginAccessIdentity": "string"},
"CustomOriginConfig": {
"HTTPPort": 123,
"HTTPSPort": 123,
"OriginProtocolPolicy": "https-only",
"OriginSslProtocols": {
"Quantity": 123,
"Items": [
"SSLv3",
"TLSv1.2",
],
},
"OriginReadTimeout": 123,
"OriginKeepaliveTimeout": 123,
},
"ConnectionAttempts": 123,
"ConnectionTimeout": 123,
"OriginShield": {
"Enabled": False,
"OriginShieldRegion": "string",
},
"OriginAccessControlId": "string",
},
Origin(
id="string",
domain_name="string",
origin_protocol_policy="https-only",
origin_ssl_protocols=[
"SSLv3",
"TLSv1.2",
],
)
],
)
}
@@ -177,42 +124,15 @@ class Test_cloudfront_distributions_using_deprecated_ssl_protocols:
id=DISTRIBUTION_ID,
region=REGION,
origins=[
{
"Id": "string",
"DomainName": "string",
"OriginPath": "string",
"CustomHeaders": {
"Quantity": 123,
"Items": [
{
"HeaderName": "string",
"HeaderValue": "string",
},
],
},
"S3OriginConfig": {"OriginAccessIdentity": "string"},
"CustomOriginConfig": {
"HTTPPort": 123,
"HTTPSPort": 123,
"OriginProtocolPolicy": "https-only",
"OriginSslProtocols": {
"Quantity": 123,
"Items": [
"SSLv3",
"TLSv1.1",
],
},
"OriginReadTimeout": 123,
"OriginKeepaliveTimeout": 123,
},
"ConnectionAttempts": 123,
"ConnectionTimeout": 123,
"OriginShield": {
"Enabled": False,
"OriginShieldRegion": "string",
},
"OriginAccessControlId": "string",
},
Origin(
id="string",
domain_name="string",
origin_protocol_policy="https-only",
origin_ssl_protocols=[
"SSLv3",
"TLSv1.1",
],
)
],
)
}
@@ -248,39 +168,14 @@ class Test_cloudfront_distributions_using_deprecated_ssl_protocols:
id=DISTRIBUTION_ID,
region=REGION,
origins=[
{
"Id": "string",
"DomainName": "string",
"OriginPath": "string",
"CustomHeaders": {
"Quantity": 123,
"Items": [
{
"HeaderName": "string",
"HeaderValue": "string",
},
],
},
"S3OriginConfig": {"OriginAccessIdentity": "string"},
"CustomOriginConfig": {
"HTTPPort": 123,
"HTTPSPort": 123,
"OriginProtocolPolicy": "https-only",
"OriginSslProtocols": {
"Quantity": 123,
"Items": ["TLSv1.2"],
},
"OriginReadTimeout": 123,
"OriginKeepaliveTimeout": 123,
},
"ConnectionAttempts": 123,
"ConnectionTimeout": 123,
"OriginShield": {
"Enabled": False,
"OriginShieldRegion": "string",
},
"OriginAccessControlId": "string",
},
Origin(
id="string",
domain_name="string",
origin_protocol_policy="https-only",
origin_ssl_protocols=[
"TLSv1.2",
],
)
],
)
}
tests/providers/aws/services/cloudfront/cloudfront_service_test.py
+5 -6
View File
@@ -196,12 +196,11 @@ class Test_CloudFront_Service:
assert (
cloudfront.distributions[cloudfront_distribution_id].logging_enabled is True
)
assert (
cloudfront.distributions[cloudfront_distribution_id].origins
== cloudfront_client.get_distribution(Id=cloudfront_distribution_id)[
"Distribution"
]["DistributionConfig"]["Origins"]["Items"]
)
for origin in cloudfront.distributions[cloudfront_distribution_id].origins:
assert origin.id == "origin1"
assert origin.domain_name == "asdf.s3.us-east-1.amazonaws.com"
assert origin.origin_protocol_policy == ""
assert origin.origin_ssl_protocols == []
assert (
cloudfront.distributions[cloudfront_distribution_id].geo_restriction_type
== GeoRestrictionType.blacklist