diff --git a/prowler/providers/aws/services/cloudfront/cloudfront_distributions_using_deprecated_ssl_protocols/cloudfront_distributions_using_deprecated_ssl_protocols.py b/prowler/providers/aws/services/cloudfront/cloudfront_distributions_using_deprecated_ssl_protocols/cloudfront_distributions_using_deprecated_ssl_protocols.py index 28d8c6bcab..3ffa7fc5f2 100644 --- a/prowler/providers/aws/services/cloudfront/cloudfront_distributions_using_deprecated_ssl_protocols/cloudfront_distributions_using_deprecated_ssl_protocols.py +++ b/prowler/providers/aws/services/cloudfront/cloudfront_distributions_using_deprecated_ssl_protocols/cloudfront_distributions_using_deprecated_ssl_protocols.py @@ -21,10 +21,8 @@ class cloudfront_distributions_using_deprecated_ssl_protocols(Check): bad_ssl_protocol = False for origin in distribution.origins: - if "CustomOriginConfig" in origin: - for ssl_protocol in origin["CustomOriginConfig"][ - "OriginSslProtocols" - ]["Items"]: + if origin.origin_ssl_protocols: + for ssl_protocol in origin.origin_ssl_protocols: if ssl_protocol in ( OriginsSSLProtocols.SSLv3.value, OriginsSSLProtocols.TLSv1.value, @@ -32,6 +30,7 @@ class cloudfront_distributions_using_deprecated_ssl_protocols(Check): ): bad_ssl_protocol = True break + if bad_ssl_protocol: report.status = "FAIL" report.status_extended = f"CloudFront Distribution {distribution.id} is using a deprecated SSL protocol." diff --git a/prowler/providers/aws/services/cloudfront/cloudfront_service.py b/prowler/providers/aws/services/cloudfront/cloudfront_service.py index 98a3e13a11..de11b3cb17 100644 --- a/prowler/providers/aws/services/cloudfront/cloudfront_service.py +++ b/prowler/providers/aws/services/cloudfront/cloudfront_service.py @@ -30,7 +30,22 @@ class CloudFront(AWSService): ): distribution_id = item["Id"] distribution_arn = item["ARN"] - origins = item["Origins"]["Items"] + origins = [] + for origin in item.get("Origins", {}).get("Items", []): + origins.append( + Origin( + id=origin["Id"], + domain_name=origin["DomainName"], + origin_protocol_policy=origin.get( + "CustomOriginConfig", {} + ).get("OriginProtocolPolicy", ""), + origin_ssl_protocols=origin.get( + "CustomOriginConfig", {} + ) + .get("OriginSslProtocols", {}) + .get("Items", []), + ) + ) distribution = Distribution( arn=distribution_arn, id=distribution_id, @@ -130,6 +145,13 @@ class DefaultCacheConfigBehaviour(BaseModel): field_level_encryption_id: str +class Origin(BaseModel): + id: str + domain_name: str + origin_protocol_policy: str + origin_ssl_protocols: list[str] + + class Distribution(BaseModel): """Distribution holds a CloudFront Distribution resource""" @@ -139,6 +161,6 @@ class Distribution(BaseModel): logging_enabled: bool = False default_cache_config: Optional[DefaultCacheConfigBehaviour] geo_restriction_type: Optional[GeoRestrictionType] - origins: list + origins: list[Origin] web_acl_id: str = "" tags: Optional[list] = [] diff --git a/tests/providers/aws/services/cloudfront/cloudfront_distributions_using_deprecated_ssl_protocols/cloudfront_distributions_using_deprecated_ssl_protocols_test.py b/tests/providers/aws/services/cloudfront/cloudfront_distributions_using_deprecated_ssl_protocols/cloudfront_distributions_using_deprecated_ssl_protocols_test.py index 8a39ba63e3..b693595fbf 100644 --- a/tests/providers/aws/services/cloudfront/cloudfront_distributions_using_deprecated_ssl_protocols/cloudfront_distributions_using_deprecated_ssl_protocols_test.py +++ b/tests/providers/aws/services/cloudfront/cloudfront_distributions_using_deprecated_ssl_protocols/cloudfront_distributions_using_deprecated_ssl_protocols_test.py @@ -1,6 +1,9 @@ from unittest import mock -from prowler.providers.aws.services.cloudfront.cloudfront_service import Distribution +from prowler.providers.aws.services.cloudfront.cloudfront_service import ( + Distribution, + Origin, +) from tests.providers.aws.utils import AWS_ACCOUNT_NUMBER DISTRIBUTION_ID = "E27LVI50CSW06W" @@ -36,41 +39,12 @@ class Test_cloudfront_distributions_using_deprecated_ssl_protocols: id=DISTRIBUTION_ID, region=REGION, origins=[ - { - "Id": "string", - "DomainName": "string", - "OriginPath": "string", - "CustomHeaders": { - "Quantity": 123, - "Items": [ - { - "HeaderName": "string", - "HeaderValue": "string", - }, - ], - }, - "S3OriginConfig": {"OriginAccessIdentity": "string"}, - "CustomOriginConfig": { - "HTTPPort": 123, - "HTTPSPort": 123, - "OriginProtocolPolicy": "https-only", - "OriginSslProtocols": { - "Quantity": 123, - "Items": [ - "SSLv3", - ], - }, - "OriginReadTimeout": 123, - "OriginKeepaliveTimeout": 123, - }, - "ConnectionAttempts": 123, - "ConnectionTimeout": 123, - "OriginShield": { - "Enabled": False, - "OriginShieldRegion": "string", - }, - "OriginAccessControlId": "string", - }, + Origin( + id="string", + domain_name="string", + origin_protocol_policy="https-only", + origin_ssl_protocols=["SSLv3"], + ) ], ) } @@ -106,42 +80,15 @@ class Test_cloudfront_distributions_using_deprecated_ssl_protocols: id=DISTRIBUTION_ID, region=REGION, origins=[ - { - "Id": "string", - "DomainName": "string", - "OriginPath": "string", - "CustomHeaders": { - "Quantity": 123, - "Items": [ - { - "HeaderName": "string", - "HeaderValue": "string", - }, - ], - }, - "S3OriginConfig": {"OriginAccessIdentity": "string"}, - "CustomOriginConfig": { - "HTTPPort": 123, - "HTTPSPort": 123, - "OriginProtocolPolicy": "https-only", - "OriginSslProtocols": { - "Quantity": 123, - "Items": [ - "SSLv3", - "TLSv1.2", - ], - }, - "OriginReadTimeout": 123, - "OriginKeepaliveTimeout": 123, - }, - "ConnectionAttempts": 123, - "ConnectionTimeout": 123, - "OriginShield": { - "Enabled": False, - "OriginShieldRegion": "string", - }, - "OriginAccessControlId": "string", - }, + Origin( + id="string", + domain_name="string", + origin_protocol_policy="https-only", + origin_ssl_protocols=[ + "SSLv3", + "TLSv1.2", + ], + ) ], ) } @@ -177,42 +124,15 @@ class Test_cloudfront_distributions_using_deprecated_ssl_protocols: id=DISTRIBUTION_ID, region=REGION, origins=[ - { - "Id": "string", - "DomainName": "string", - "OriginPath": "string", - "CustomHeaders": { - "Quantity": 123, - "Items": [ - { - "HeaderName": "string", - "HeaderValue": "string", - }, - ], - }, - "S3OriginConfig": {"OriginAccessIdentity": "string"}, - "CustomOriginConfig": { - "HTTPPort": 123, - "HTTPSPort": 123, - "OriginProtocolPolicy": "https-only", - "OriginSslProtocols": { - "Quantity": 123, - "Items": [ - "SSLv3", - "TLSv1.1", - ], - }, - "OriginReadTimeout": 123, - "OriginKeepaliveTimeout": 123, - }, - "ConnectionAttempts": 123, - "ConnectionTimeout": 123, - "OriginShield": { - "Enabled": False, - "OriginShieldRegion": "string", - }, - "OriginAccessControlId": "string", - }, + Origin( + id="string", + domain_name="string", + origin_protocol_policy="https-only", + origin_ssl_protocols=[ + "SSLv3", + "TLSv1.1", + ], + ) ], ) } @@ -248,39 +168,14 @@ class Test_cloudfront_distributions_using_deprecated_ssl_protocols: id=DISTRIBUTION_ID, region=REGION, origins=[ - { - "Id": "string", - "DomainName": "string", - "OriginPath": "string", - "CustomHeaders": { - "Quantity": 123, - "Items": [ - { - "HeaderName": "string", - "HeaderValue": "string", - }, - ], - }, - "S3OriginConfig": {"OriginAccessIdentity": "string"}, - "CustomOriginConfig": { - "HTTPPort": 123, - "HTTPSPort": 123, - "OriginProtocolPolicy": "https-only", - "OriginSslProtocols": { - "Quantity": 123, - "Items": ["TLSv1.2"], - }, - "OriginReadTimeout": 123, - "OriginKeepaliveTimeout": 123, - }, - "ConnectionAttempts": 123, - "ConnectionTimeout": 123, - "OriginShield": { - "Enabled": False, - "OriginShieldRegion": "string", - }, - "OriginAccessControlId": "string", - }, + Origin( + id="string", + domain_name="string", + origin_protocol_policy="https-only", + origin_ssl_protocols=[ + "TLSv1.2", + ], + ) ], ) } diff --git a/tests/providers/aws/services/cloudfront/cloudfront_service_test.py b/tests/providers/aws/services/cloudfront/cloudfront_service_test.py index 83a68929da..fdf871a87b 100644 --- a/tests/providers/aws/services/cloudfront/cloudfront_service_test.py +++ b/tests/providers/aws/services/cloudfront/cloudfront_service_test.py @@ -196,12 +196,11 @@ class Test_CloudFront_Service: assert ( cloudfront.distributions[cloudfront_distribution_id].logging_enabled is True ) - assert ( - cloudfront.distributions[cloudfront_distribution_id].origins - == cloudfront_client.get_distribution(Id=cloudfront_distribution_id)[ - "Distribution" - ]["DistributionConfig"]["Origins"]["Items"] - ) + for origin in cloudfront.distributions[cloudfront_distribution_id].origins: + assert origin.id == "origin1" + assert origin.domain_name == "asdf.s3.us-east-1.amazonaws.com" + assert origin.origin_protocol_policy == "" + assert origin.origin_ssl_protocols == [] assert ( cloudfront.distributions[cloudfront_distribution_id].geo_restriction_type == GeoRestrictionType.blacklist